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Preface 


The  purpose  of  this  thesis  was  to  develop  a  filter  model 
and  failure  detection/ identification  system  for  the  initial 
phase  of  an  adaptive  tactical  navigation  ( ATN)  simulation 
program.  This  thesis  topic  was  suggested  by  Mr.  Brian  Mahon 
to  support  a  current  Air  Force  Avionics  Laboratory  research 
effort . 

The  filter  model,  as  well  as  the  failure 
detection/ identification  system  (designed,  tuned,  and  tested 
against  no-failure  and  failed  sensor  conditions  in  both 
benign  and  highly  dynamic  flight  scenarios)  demonstrated  good 
performance  and  provided  some  expected  results.  However, 
additional  filter  tuning  and  threshold  adjustments  are  needed 
to  optimize  the  system's  performance. 

I  am  proud  to  have  been  associated  with  and  am  truly 
indebted  to  my  faculty  advisor.  Dr.  Peter  S.  Maybeck  and 
thesis  reader.  Captain  Stephen  E.  Cross.  I  also  wish  to 
thank  Stan  Musick  and  Sandy  Berning  of  the  Avionics  Lab  for 
their  assistance.  I  wish  to  express  a  heart  felt  thanks  to 
my  wife,  Bonnie,  and  my  sons,  Brent  and  Greg.  Their  love  and 
untiring  support  has  helped  me  through  the  thesis  as  well  as 
the  academic  program  that  has  brought  me  to  this  point  in  my 
formal  education. 


Gary  R.  Johnston 
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Abstract 

This  research  effort  aimed  at  the  design  of  a  suitable 
filter  model  and  failure  detection/ identification  (FDI)  pro¬ 
cessor  as  a  basis  for  the  development  of  a  fully  simulated 
adaptive  tactical  navigation  (ATN)  system.  A  52-state  "truth" 
error  model  was  developed  from  which  a  26-state  filter  error 
model  was  derived.  The  measurement  process  utilizes  a  six 
measurement  satellite  positioning  system  (three  velocity  mea¬ 
surements  and  three  position  measurements) ,  a  three  measure¬ 
ment  Doppler  radar  (three  velocity  measurements) ,  and  a  ter¬ 
rain  correlation  system  (three  position  measurements).  The 
filter  residuals  for  the  different  measurement  processes  are 
then  utilized  in  N-step  likelihood  function  computations  to 
observe  the  residual  behavior.  Two  different  testing  criteria 
have  been  developed  for  failure  declaration.  Simple  threshold 
establishment  and  the  tracking  of  the  likelihood  function  N- 
step  slope  characteristics  are  utilized  for  this  purpose. 

Based  on  the  statistics  of  the  observed  failure  characteristics, 
an  isolation/identification  processor  isolates  the  fault  and 
makes  the  correct  identification. 

The  analysis  was  performed  by  simulating  both  "soft"  and 
"hard"  failures  and  monitoring  the  likelihood  function  behav¬ 
ior.  The  observed  failure  characteristics  then  triggered  the 
appropriate  isolation/identification  logic  and  the  failed  sen- 


sor  decision  was  made.  The  test  results  indicate  that  this 
FDI  process  warrants  further  consideration.  Readdressing  the 
basic  issues  of  filter  state  reduction,  tuning,  threshold  set 
tings,  and  "window"  size  will  undoubtedly  improve  the  perform¬ 
ance  of  this  system. 


INVESTIGATION  OF  A  FAILURE  DETECTION/ IDENTIFICATION 
SYSTEM  FOR  A  TACTICAL  AIRCRAFT  NAVIGATION  SYSTEM 

I .  Introduction 

Overview 

The  requirement  for  precise  weapon  delivery  has 
generated  the  need  for  highly  accurate  navigation  during  a 
tactical  mission.  Without  this  accuracy,  weapon  delivery 
will  most  likely  be  ineffectual.  During  the  tactical 
mission,  selecting  sensors  for  updating  the  navigation  system 
can  become  very  time  consuming  and  complex  for  the  aircrew. 
This  could  force  the  aircrew  to  spend  a  substantial  amount  of 
time  concerned  about  what  suite  of  sensors  will  ensure  the 
success  of  their  particular  mission.  Their  time  could  be 
more  effectively  used  for  activities  that  may  be  important  at 
that  particular  mission  phase.  For  the  purpose  of  this 
paper,  accurate  weapon  delivery  will  represent  the  measure  of 
meeting  the  mission  objective. 

An  automated  system  is  desired  which  will  use  the 
probability  of  target  kill  and  the  probability  of  aircraft 
survival  when  making  a  sensor  suite  selection.  This 
automated  system  may  consider  such  data  as  prestored  map 
features,  threat  information,  flight  plan,  sensor 
characteristics  (e.g.,  signatures  to  the  enemy  and  the 
sensor's  accuracy  in  the  current  environment)  as  well  as  the 


degree  of  navigation  accuracy  required  for  the  particular 
mission  phase.  Also,  real-time  information,  such  as  radar 
illumination  from  an  unknown  site  (due  to  a  sensor  or  sensors 
presently  in  use),  a  change  in  route,  a  change  in  target,  a 
sensor  failure/degradation,  or  sensor  jamming  must  also  be 
taken  into  account  when  optimizing  the  navigation  system. 

A  key  element  for  this  automated  system,  referred  to  as 
adaptive  tactical  navigation  (ATN) ,  is  the  failure  detection 
and  identification  (FDI)  system.  The  FDI  system  has  the 
essential  job  of  ensuring  that  an  accurate  sensor  suite  is 
functioning  at  all  times.  This  will  ultimately  ensure  the 
peak  performance  of  the  ATN  system.  The  FDI  system  must 
continuously  monitor  the  performance  of  the  inertial 
navigation  system  (INS)  and  any  external  aiding  sensors  to 
ensure  that  they  are  functioning  within  acceptable  limits. 
If  a  sensor  or  sensors  are  malfunctioning,  the  FDI  system 
must  detect  the  malfunction,  identify  the  failed  sensor  or 
sensors,  and  then  pass  this  information  to  the  ATN  system 
computer  for  sensor  removal,  compensation,  or  reselection. 
There  are  several  FDI  processes  which  have  been  developed 
(30).  Each  of  them  have  both  positive  and  negative 
attributes.  Positive  attributes  would  be  represented  by  ease 
of  implementation  and  reduced  computational  load.  Negative 
attributes  are  exemplified  by  high  false  alarm  rates 
(declaring  a  failure  when  no  failure  has  occurred)  or  non¬ 
detection  of  low-level  ("soft”)  failures.  An  "optimal"  (in 


this  case,  optimal  implies  minimal  false  alarms  and  timely 
detection  and  identification)  FDI  process  is  needed  which  has 
a  high  degree  of  reliability.  Without  this  reliability,  the 
ATN  system  will  not  achieve  the  peak  performance  needed  to 
contribute  to  the  success  of  a  tactical  mission. 

Background 

The  following  information  is  included  to  provide  the 
reader  with  the  historical  perspective  of  FDI  process 
development  and  to  make  a  distinction  between  the  objective 
of  this  thesis  and  the  works  of  others. 

Before  an  explanation  of  the  FDI  processes  can  occur,  an 
overview  of  the  filtering  process  is  in  order  (24:3-7).  For 
an  aircraft  navigation  problem,  the  quantities  that  describe 
the  "state"  of  the  system  cannot  be  measured  directly, 
therefore,  the  desired  values  must  be  derived  from  the 
available  data  (e.g.,  an  air  data  system  directly  provides 
static  and  pitot  pressures,  the  aircraft  heading  and 
reference  system  provides  Euler  angles,  etc.).  From  this 
data,  velocity  and  position  can  be  determined.  The  system  is 
typically  driven  by  inputs  other  than  those  that  are  known 
and  the  correlation  among  the  states  is  only  known  with  a 
degree  of  certainty.  The  measurement  of  these  quantities  is 
also  corrupted  by  noise,  bias,  and  inaccuracy.  If  a  number 
of  measuring  devices  are  available,  some  means  of  combining 
their  measurement  information  in  an  optimal  and  systematic 
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fashion  is  needed.  The  Kalman  filter  combines  this  available 
measurement  data  with  apriori  information  about  the  system 
and  measurement  devices  to  provide  a  statistically  error- 
minimized  solution. 

The  FDI  process  has  the  responsibility  for  the  detection 
of  undesirable  characteristics  in  the  system.  For  actuators 
these  characteristics  are  exhibited  by  shifts  in  the  control 
input  gains  (B  matrix),  increased  processing  noise,  or  a  bias 
in  the  measurements.  On  the  other  hand,  sensor  failures 
usually  manifest  themselves  as  abrupt  changes  in  the 
measurement  gain  (H  matrix)  ,  increases  in  measurement  noise, 
or  as  biases  in  the  measurements  themselves.  The 
characteristics  usually  are  strongly  exhibited  in  the 
residuals  generated  by  the  filter  or  in  related  difference 
expressions  (difference  expressions  not  considered  residuals 
would  be  the  equations  which  compare  failed-state  modeling  to 
The  measured  quantity  and  the  difference  is  not  used  for 
filter  update  but  for  failure  detection)  (11:47).  For  the 
purpose  of  this  paper,  the  issue  of  sensor  failure  detection 
will  be  addressed. 

There  are  several  FDI  techniques  which  offer  various 
tradeoffs,  advantages,  and  disadvantages.  Based  on  the 
general  approach  of  the  FDI  technique,  it  can  be  placed  into 
one  of  the  following  categories  (47): 

(1)  failure  sensitive  filter 

(2)  voting  systems 


(3)  multiple  hypothesis  filter-detectors 

(4)  jump  process  formulations 

(5)  innovations  -  based  detection  systems 

Failure-sensitive  filters  (12:17;44)  are  aimed  at  the 
"oblivious"  filter.  If  the  filter,  because  of  its  structure, 
learns  the  state  too  well,  (as  a  result  of  too  small  of  a 
filter  covariance,  P,  and  filter  gain,  K)  ,  it  will  tend  to 
rely  heavily  on  old  measurement  data  and  will  neglect  new 
measurement  data.  Therefore,  if  an  abrupt  change  occurs,  the 
filter  will  not  react  in  a  timely  manner.  The  1964  work  of 
Fagin  (12)  produced  an  exponentially  age-weighted  filter. 
This  technique  reduced  the  filter's  reliance  on  old  data  in 
an  exponential  fashion.  In  1970,  this  technique  was  further 
!•  explored  by  Tarn  and  Zaborsky  (17).  The  efforts  of  Jazwinski 

in  1968  (44),  produced  the  finite  -  memory  filter.  He  also 
proposed  methods  such  as  increasing  the  noise  covariance  or 
1  fixing  filter  gain  in  a  1970  paper  (18).  These  techniques 

offer  indirect  failure  information,  which  means  this  type  of 
filter  responds  faster  than  the  base  filter  to  abrupt 
i  changes.  The  drawback  to  this  approach  is  the  increase  in 

filter  bandwidth  due  to  the  increased  allowance  of  new  data 
to  influence  filter  behavior.  This  increased  bandwidth 
»  degrades  the  performance  of  the  filter  under  normal  operating 

conditions.  One  possible  solution  is  a  two-filter  system  (a 
normal  mode  filter  and  a  failure  mode  filter).  Several 
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methods  have  been  developed  which  model  the  failure  of 
sensors  as  states  in  the  filter  which  are  then  directly 
compared  to  their  nominal  values,  to  declare  or  not  declare  a 


failure  based  on  the  results  of  the  comparison.  This 
technique  provides  quick  response  at  the  expense  of  increased 
filter  dimensionality  and  some  performance  degradation  due 
to  the  increased  bandwidth  caused  by  the  additional  states. 
The  further  effort  of  Beard  (46)  and  Jones  (47)  in  1S73, 
produced  a  design  procedure  which  allows  particular  failure 
modes  to  manifest  themselves  as  residuals  which  remain  in  a 
fixed  direction  or  in  a  fixed  plane  in  the  failure  subspace. 
This  failure  subspace  is  the  set  of  vectors  which  represent 
the  failure  modes  which  could  occur.  These  vectors  generate 
a  subspace  from  which  it  is  possible  to  determine  the  failure 
mode.  By  the  construct  of  this  algorithm,  the  residual 
remains  in  a  fixed  direction  and  has  a  magnitude  which  is 
proportional  to  the  failure  size.  The  Jones  method  can  be 
used  to  detect  a  wide  variety  of  failures  and  provides 
detailed  failure  isolation  information;  however,  it  is  not  an 
optimal  estimator  (optimal  in  the  sense  that  it  can  only 
handle  specific  types  of  failures  with  specific 
characteristics).  This  implies  this  type  of  filter  would  be 
slow  or  completely  oblivious  to  detect  a  failure  which  has 
not  been  addressed  in  the  failure  filter  design. 
Furthermore,  its  construct  is  only  applicable  to  the  time- 
invariant  system. 


Voting  systems  are  useful  in  systems  that  possess  a  high 
degree  of  parallel  hardware  redundancy.  The  work  of  Gilmore 
and  McKern  (1970)  (13)  discusses  the  use  of  this  technique  to 
detect  "hard"  gyro  failures.  Standard  voting  schemes  require 
at  least  three  identical  devices  to  determine  which  device 
has  failed  (with  two  devices,  only  a  discrepancy  between  them 
can  be  determined  but  not  an  indication  of  which  one  actually 
failed).  In  1974,  Broen  (2)  proposed  a  voter  -  estimator 
scheme  which  generates  a  "soft"  voting  procedure  that  removes 
the  data  from  a  failed  sensor  in  a  weighted  fashion  so  as  to 
reduce  false  alarms  caused  by  transients  (rapid  removal  of 
this  sensor  could  cause  a  large  change  in  the  measurement 
residual).  This  technique  uses  a  variable  which  is  a 
function  of  the  like  -  sensor  measurements.  This  variable 
has  a  small  value  if  the  measurement  of  a  particular  sensor 
is  different  from  the  others  and  a  large  value  if  it  is  close 
to  the  others.  The  variable  is  then  used  to  find  the  value 
of  a  filter  state  that  minimizes  a  likelihood  function  for 
the  innovations  sequence.  Since  the  likelihood  function 
output  is  not  directly  used  to  determine  which  sensor  has 
failed,  a  failed  sensor  still  has  this  "soft"  vote.  This 
approach  greatly  lessens  false  alarms  but  requires  on-line 
computation  of  the  filter  gain.  In  general,  voting  schemes 
are  easy  to  implement  and  provide  fast  detection  of  hard 
failures,  but  can  only  be  implemented  in  systems  that  have  a 
high  degree  of  parallel  hardware  redundancy.  They  cannot 


take  advantage  of  information  from  unlike  sensors  and  are 
extremely  poor  at  detecting  "soft"  failures. 

Multiple  hypothesis  filter  detectors  are  based  on 
different  hypotheses  concerning  system  behavior.  A  "bank"  of 
(linear)  filters  is  utilized,  each  of  which  models  a 
different  hypothesis.  This  approach  requires  both  the  filter 
modeling  of  the  hypotheses  and  a  conditional  probability 
generated  from  the  filter's  residuals.  This  information  is 
then  used  to  determine  the  probability  that  each  hypothesis 
is  correct.  The  technique  allows  simultaneous  state 
estimation  and  failure  identification.  Willsky,  Deyst,  and 
Crawford  (1974,  1975)  (48:51)  applied  the  methodology 
developed  by  Buxbaum  and  Haddad  (1969)  (4)  for  the  detection 
of  failures  in  an  INS.  The  theoretically  optimum 
implementation  of  the  algorithm  requires  an  exponentially 
growing  bank  of  filters  due  to  the  fact  that  each  filter  is 
associated  with  a  time  history  of  hypothesis  decisions,  and 
the  number  of  such  sequences  grows  exponentially  with  time. 
Several  approximation  techniques  have  been  proposed  to 
alleviate  this  problem.  This  proposal  of  Willsky,  Deyst,  and 
Crawford  used  an  "N-step"  window.  The  "shift"  (growth)  of 
the  residual  bias  due  to  failed  behavior  is  hypothesized  as 
occurring  once  in  the  N-steps.  If  no  abnormal  behavior  is 
observed  in  the  N-steps,  the  N  conditional  densities  (these 
densities  represent  the  probability  of  a  shift  conditioned  on 
the  measurement  history)  are  fused  into  a  single  density  and 


the  N-step  process  is  repeated.  The  fused  density  allows  the 
filter  bank  to  be  reinitialized  which  means  it  will 
essentially  remain  sensitive  to  new  information.  Another 
approach  using  the  N-step  window  was  proposed  by  Newbold  and 
Ho  (1968)  (16).  The  approach  is  called  a  sequential 
probability  ratio  test  (SPRT).  It  operates  based  on  a  two- 
hypothesis  decision  rule  (e.g.,  system  character 
changed/didn't  change)  and  compares  aposteriori  probabilities 
of  the  two  hypotheses  by  means  of  the  log  ratio  of  the  two 
probabilities.  This  log  ratio  is  then  compared  to 
predetermined  thresholds  (these  thresholds  have  been 
empirically  established  based  on  desired  detection 
sensitivity)  and  then  either  no  decision  is  made,  in  which 
case  another  measurement  is  brought  in  and  added  to  the 
previous  N  inputs,  or  a  decision  is  made.  This  means  that  the 
value  of  N  is  dynamic  and  enhances  the  detection  capability 
of  the  detection  process;  however,  the  "soft"  failure  of  a 
device  which  occurs  in  the  middle  of  an  N-step  process  may  go 
undetected  until  the  next  test  occurs.  Further  techniques 
proposed  by  Nahi  (1969)  (38)  considered  the  use  of  multiple 
hypothesis  modeling  to  develop  a  linear  estimator  for  the 
system  which  accounts  for  any  measurement  that  might  contain 
only  noise.  For  a  measurement  that  contains  only  noise,  the 
H  matrix  for  that  hypothesis  is  a  matrix  of  zeroes.  This  in 
effect  models  "hard"  sensor  failure  which  was  unaddressed  in 
earlier  work.  The  multiple  decision  process  remains  intact. 


This  technique  does  not  remove  bad  measurements  or  allow  the 
filter  structure  to  adapt. 

Jump  process  formulations  are  the  result  of  the 
requirement  of  an  FDI  system  to  detect  abrupt  changes  in  a 
dynamic  system  in  the  shortest  possible  amount  of  time. 
Basically,  this  technique  involves  the  characterization  of 
apriori  information  concerning  failure  rates.  The  magnitude 
of  possible  failures  is  assumed  to  be  known  value  which 
allows  the  designer  to  model  the  detection  system  to 
hypothesize  a  certain  threshold  based  on  a  detected  rate  of 
growth  in  the  residual.  Work  by  Sworder  and  Robinson,  (1973) 
(41),  and  Ratner  and  Luenberger  (1973)  (40)  have  focused  on 
the  finite  jump  of  system  matrices  among  a  finite  set  of 
possible  matrices  which  are  generated  apriori  for  different 
failures  and  for  the  no-failure  condition.  The  major 
deficiency  in  this  approach  is  the  unaddressed  issue  of 
system  randomness  (e.g.,  the  lack  of  statistically  describing 
the  jump  characteristics).  Since  the  jump  matrices  are  for  a 
specific  set  of  failure  descriptions,  there  is  no  flexibility 
in  this  approach  to  detect  unmodeled  jump  failures.  Davis 
(1975)  (10)  has  worked  the  fault  detection  problem  using 
nonlinear  methodology  (e.g.,  he  has  modeled  his  detection 
formulation  based  on  nonlinear  state  equations  and 
measurement  formulations).  At  the  time  of  this  writing,  no 
study  of  this  technique  had  been  made  which  would  establish 
its  performance;  however,  this  technique  is  suboptimal  as  a 
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state  estimator  since  its  tuning  has  been  based  on  failed- 
sensor  statistics.  Chien  (1972)  (3)  devised  a  failure 
detection  method  which  circumvents  the  suboptimal  state 
estimate  problem  and  provides  detection  of  a  jump  or  ramp  in 
the  system.  The  approach  demonstrated  detector  simplicity 
and  use  of  a  scalar  stochastic  equation  which  allows  direct 
failure  estimates  (one  equation  for  each  failure  type).  The 
method  also  has  built-in  robustness  to  account  for  modeling 
errors  (through  incorporation  of  white  noise  processes), 
eliminates  suboptimal  filter  performance  for  no-failure 
operation,  through  the  use  of  a  time-probability  description 
for  the  failure  description,  alleviates  the  problem  of  the 
previously  addressed  "oblivious"  filter.  The  design  method 
utilizes  a  nominal  size  bias  and  steady-state  evaluation  of 
the  failure/residual  relationship  to  establish  a  stochastic 
differential  equation  for  the  probability  of  a  failure  given 
the  measurement. 

Failure  transients  have  not  been  properly  addressed, 
which  means  that  a  time  delay  for  failure  detection  may 
result  while  waiting  for  the  failure  to  reach  steady-state 
condition. 

Innovations  -  based  detection  systems  involve  the 
residual  monitoring  of  a  filter  based  on  normal  and/or  failed 
hypotheses.  Chien's  method  (30)  which  was  addressed  in  the 
previous  paragraph,  can  also  be  placed  in  this  group  due  to 
his  method  of  residual  usage.  The  flexibilty  of  this 
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methodology  is  obvious.  Since  the  filter  model  operates 
under  no-failure  conditions  (statistics  are  for  no-failure 
condition),  the  FDI  system  uses  the  residuals  generated  by 
the  filter  state  estimate  and  the  measurement  to  determine 
the  sensor  or  sensors'  operating  condition.  This  technique 
exploits  the  characteristics  of  the  residuals  (e.g.,  the 
residual  should  be  zero-mean,  white,  Gaussian,  and  have  a 
covariance  of  (HP“HT  +  R) ,  as  computed  in  the  filter  if  the 
filter  is  well  tuned,  and  if  its  hypothesis  under  no-failure 
conditions  is  correct).  The  residuals  under  failed 
conditions  would  exhibit  biases  or  amplitude  increases.  The 
FDI  system  may  also  have  to  distinguish  between  different 
failure  modes  which  would  require  techniques  such  as  multiple 
hypotheses  or  likelihood  function  or  ratio  formulations  to 
perform  adequately.  Mehra  and  Peschon  (31)  have  proposed 
several  different  statistical  tests  to  be  performed  on 
residuals.  One  proposed  method  involves  the  chi-squared  test 
as  utilized  by  Willsky,  Deyst,  and  Crawford  (1974-75) 
(48;50).  This  method  relies  on  Np  degress  of  freedom  ,  where 
N  represents  the  residual  "window"  length  and  p  represents 
the  p-dimensional  residual  vector.  The  operation  of  this 
approach  is  based  on  the  chi-squared  random  variable 
exceeding  some  predetermined  threshold  which  has  been 
established  by  the  previously  described  residual 
characteristics.  The  chi-squared  variable  is  the  (residual^/ 
sigma^),  where  sigma  was  previously  defined  by  HP“HT  +  R  and 


the  residual  is  the  difference  of  the  measurement  and  the 
filter's  estimate.  Under  the  conditions  of  no  uncertainty 
this  value  would  have  a  mean  value  of  1,  since  the  filter's 
estimated  variance  would  equal  the  residual  squared,  on  the 
average.  Deficiencies  of  the  N-step  window  size  (e.g.,  too 
large  or  too  small  a  value  of  N)  may  result  in  the  non¬ 
detection  or  late-detect ion  of  failures  due  to  too  large  a 
value  of  N  and  on  the  other  hand,  too  small  a  value  of  N  may 
result  in  a  high  false  alarm  rate.  Merrill  (1972)  (30) 
developed  a  technique  whereby  bad  sensor  data  is  suppressed. 
Another  technique  compares  the  actual  measurement  at  any 
point  in  time  to  the  predicted  value  of  the  measurement  based 
on  the  weighted  history  of  previous  data  and  incorporates 
this  into  the  algorithm  as  an  additional  measurement  of  the 
present  state.  This  method,  which  was  researched  by  Peterson 
(1975)  (30),  involves  the  incorporation  of  work  done  with 
weighted  residual  tests  done  by  Chow,  Dunn,  and  Willsky 
(1975)  (8)  and  the  previous  work  of  Merrill  (30).  Another 
technique  which  has  been  explored  by  such  researchers  as 
Willsky,  Jones,  McAulay,  Denlirger,  Deyst,  Deckert,  Sanyal, 
Shen,  Chow,  and  Dunn  (7  ;  8 ; 9 ; 3 0 ;  42 ;  4 6)  ,  is  the  use  of  what  is 
referred  to  as  the  generalized  likelihood  ratio  (GLR) ,  which 
was  motivated  by  the  deficiencies  of  the  chi-squared 
procedure.  The  GLR  method  utilizes  knowledge  of  the  effects 
particular  failures  have  on  the  measurement  residual.  In 
general,  this  method  provides  an  optimum  decision  rule  for 


failure  detection  and  provides  failure  identification 
information  to  aid  the  system  reconfiguration  after  a  failure 
has  been  detected.  This  technique  utilizes  the 
precomputation  of  a  "failure  signature  matrix"  which  provides 
an  explicit  description  of  how  various  failures  propagate 
through  the  system.  Also,  the  "time-to-f ailure",  modeled  as 
a  random  variable,  is  determined  from  the  maximum  likelihood 
function  using  the  residuals  of  the  measurement  process. 
This  variable  keeps  the  detection  system  open  to  new  data  and 
gives  the  system's  FDI  processor  time  to  adjust  to  dynamic 
characteristics  of  the  flight.  Full  implementation  of  this 
technique  requires  a  linearly  growing  bank  of  matched 
filters.  Simplifications,  such  as  "windowing"  the  "time-to- 
failure"  random  variable,  will  help  eliminate  the  growing 
complexity  of  the  detection  scheme.  Further  simplification 
of  the  "failure  signature  matrix"  to  eliminate  transient 
effects  (e.g.,  develop  a  steady-state  matrix  which  neglects 
the  time-varying  characteristics  of  the  matrix  design)  and 
specifying  the  failure  magnitude  apriori  will  reduce  the 
computational  burden. 

The  work  of  these  researchers  has  highlighted  key  issues 
that  should  be  considered  when  weighing  the  various  detection 
methods.  The  most  important  issues  are: 

(1)  Types  of  failure  modes  that  can  be  detected 

(2)  Complexity  of  implementation 
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(3)  Performance  as  measured  by  false  alarms, 
delays  in  detection,  missed  alarms 

(4)  Robustness  in  the  face  of  modeling  errors. 

Each  of  the  various  addressed  detection  schemes  have  both 
advantages  and  drawbacks  which  must  be  measured  against  the 
aforementioned  criteria. 

Problem 

This  thesis  will  address  the  issue  of  performance  with 
respect  to  the  four  criteria  just  listed,  for  prospective 
designs  of  the  FDI  system  of  a  high  performance  aircraft 
operating  in  a  highly  dynamic  environment. 

Scope 

The  investigation  of  this  problem  will  consist  of  an 
analysis  of  the  present  FDI  technical  groupings  as  previously 
discussed  in  this  chapter.  Computer  modeling  of  the  FDI 
technique  or  techniques  which  warrant  further  consideration 
will  then  be  addressed. 

The  computer  model  to  simulate  the  real  world 
environment  consists  of  a  local-level  strapdown  INS  and  an 
external  aiding  sensor  set  consisting  of  a  global  (satellite) 
positioning  system  (GPS),  a  radar  altimeter,  a  terrain 
map/correlation  system,  and  Doppler  Radar  (see  Figure  1.1). 
The  INS/external  aiding  package  will  then  have  the  FDI 
modeling  package  appended  for  an  analysis  of  the  various  FDI 


features 


Figure  1.1.  Sensor-Aided  INS/FDI  System 
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The  externally  sensor-aided  INS/FDI  package  will  then  be 
"flown"  against  a  simulated  (computer  generated)  flight 
profile  which  will  offer  different  dynamic  features  to 
exercise  the  FDI  system  fully  and  establish  its  strengths  and 
weaknesses.  Further,  this  will  provide  a  basis  for  the 
simulation  of  various  sensor  failure/degradations  due  to  the 
presence  of  noise/ jamming  or  their  own  internal  failures. 

Assumptions 

The  following  list  of  assumptions  represent  the 
practical  limits  which  will  be  placed  on  the  development  of 
this  thesis: 

1.  The  modeling  of  the  basic  INS  will  be  based  on  a  35- 
state  error  model  (1:35)  for  a  dry-tuned  strapdown  system 
that  maintains  navigation  information  in  a  local-level 
coordinate  frame. 

2.  The  states  associated  with  the  external  aiding 
sensors  will  be  augmented  to  the  basic  INS  to  generate  the 
desired  "truth"  model. 

3.  The  error  analysis  will  be  based  on  a  set  of 
linearized  INS/external  sensor  error  equations. 

4.  The  FDI  techniques  addressed  in  this  thesis 
represent  those  that  are  currently  known  and  documented. 

5.  The  generic  modeling  information  for  the  sensors  and 
INS  to  be  used  is  accurate. 
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6.  The  information  to  be  derived  from  available 
computer  simulation  program  for  the  flight  profile  and  the 
filter  design  program  are  accurate. 

7.  Information  gathered  from  published  documents 
represent  facts  which  require  no  proof. 

Standards 

The  measure  of  the  performance  of  the  FDI  processor  will 
be  based  on  its  ability  to  detect  failures/degradations  and 
to  report  the  deficiency  in  a  timely  manner.  Also,  the 
deficient  sensor  must  be  properly  identified. 

Approach 

The  first  phase  of  the  thesis  will  be  the  generation  of 
a  "truth"  model  for  the  INS  and  the  sensors.  From  this 
model,  a  Kalman  filter  package  will  be  developed  which  will 
be  tuned  against  the  error-state  "truth"  model  to  provide  an 
accurate  on-board  filter  representation. 

The  second  phase  will  be  the  design  of  an  FDI  system. 
This  system  will  be  developed  as  the  result  of  an  in-depth 
analysis  of  currently  documented  FDI  techniques.  Based  on 
this  analysis,  a  decision  will  be  made  as  to  which  technique 
or  techniques  will  be  addressed  turther.  The  FDI  system  will 
then  be  combined  with  the  INS/sensor  package  to  provide  a 
satisfactory  computer  model  for  the  flight  test. 

The  third  phase  will  result  in  the  test  of  this  FDI 
system  with  the  flight  profile  simulation.  The  complete 


1-18 


I 


I 


package  will  be  exercised  to  simulate  various  sensor 
failures/degradations  due  to  excessive  measurement  noise, 
jamming,  and  internal  sensor  failure. 

Performance  sensitivity  analyses  will  also  be  performed. 
The  analyses  will  focus  on  the  adequacy  of  the  FDI  system  as 
a  function  of  the  measuring  device  accuracy.  This  approach 
will  separate  the  issues  of  how  FDI  performance  is  affected 
by  measurement  inaccuracy  from  the  fundamental  performance 
bound  of  tne  FDI  system  with  perfect  measurements. 

Phase  four  will  be  the  analysis  of  post-flight  data  to 
establish  the  performance  characteristics  of  the  FDI  system. 
Recommendations  and  conclusions  will  then  be  extracted  from 
this  analysis  to  provide  a  basis  for  further  research. 

Outline  of  Thesis 

This  thesis  is  divided  into  five  chapters.  Included  in 
Chapter  I  is  an  overview  of  the  ATN  concept,  a  discussion  of 
the  research  in  FDI  methodology  which  provides  a  basis  for 
this  thesis,  and  a  discussion  of  the  assumptions  and 
limitations  pertaining  to  the  objective  of  this  thesis. 

Chapter  II  includes  a  description  of  the  "truth"  model, 
a  discussion  of  the  simulation  philosophy,  a  description  of 
the  simulation  software,  a  definition  of  the  flight  profile, 
a  description  of  the  Monte  Carlo  technique  for  the  simulation 
and  analysis,  and  a  presentation  of  the  si mulat ion  results  for 
an  unaided  INS.  The  unaided  INS  results  provide  credibility 


for  the  truth  model  since  the  plots  are  representative  of 
errors  seen  in  flight  testing  (45). 

Chapter  III  includes  a  definition  of  the  reduced  error 
model  used  in  the  filter,  the  filter  time  propagation  and 
update  equations,  and  the  presentation  of  aided  INS 
simulation  results  under  no-failure  conditions. 

Chapter  IV  presents  the  currently  documented  FDI 
methodologies  and  a  decision  as  to  which  techniques  will  be 
incorporated  into  the  FDI  system.  A  failure  mode  analysis 
will  be  included  in  this  chapter.  Also  included  in  this 
chapter  are  the  simulation  results  for  this  FDI  system. 

Chapter  V  presents  an  analysis  of  the  FDI  system  based 
on  its  performance  with  the  INS/sensor  package.  The 
performance  measure  will  be  based  on  the  comparison  of  the 
time  and  type  of  failure/degradation  and  the  system's  ability 
to  identify  the  failed  sensor.  Finally,  conclusions  and 
recommendations  will  be  set  forth  to  provide  a  basis  for  the 
next  step  in  establishing  the  benchmark  for  an  ATN  system. 


II.  The  System  Truth  Model 

The  Truth  Model 

A  "truth  model"  is  what  the  system  designer  perceives  to 
be  the  best  description  of  the  real  world  behavior  of  the 
system.  This  particular  system  consists  of  the  basic  INS,  a 
baro-a 1 timeter ,  a  satellite-positioning  system,  a  terrain 
correlation  system,  and  Doppler  radar.  In  this  section,  a 
52-state  system  error  model  is  developed  in  the  form  of  a 
linear  stochastic  vector  differential  equation  as  shown  in 
Eq  ( 2-1 ) . 

x(t)  =  F  x(t)  +  G(t)  w ( t )  (2-1) 

where : 

x(t)  is  the  52-dimensional  state  vector 

F ( t)  is  the  (52  x  52)  fundamental  matrix 

w(t)  is  a  (15  x  1)  vector  of  white  noise  forcing 
functions,  and 

G(t)  is  a  (52  x  15)  input  matrix 

Eq ( 2 - 1 )  represents  a  set  of  52  first-order  linear 
differential  equations  which  model  the  errors  and  error 
sources  in  the  externally-aided  INS. 


The 

INS 

which  is  m 

ode  1 ed 

in  this  thesis 

is  an  0.8 

nautical 

mil 

e  per  hour 

(NM/HR) 

,  local-level, 

s  trapdown 

system. 

It 

is  designed 

to  be 

representative 

of  medium 

accuracy  INSs  currently  developed  for  tactical  aircraft. 
Gyroscopes  and  accelerometers  are  mounted  on  a  navigation 
base  or  platform  that  is  directly  attached  to  the  vehicle. 
No  gimbals  isolate  the  instruments  from  the  angular  velocity 
of  the  vehicle.  To  keep  track  of  accelerometer  orientation, 
gyros  or  other  rate  sensors  are  used  to  measure  the  angular 
velocity  of  the  vehicle  in  inertial  space.  Transformation 
from  platform  to  geographic  ("navigation")  coordinates  is 
handled  by  maintaining  the  current  solution  for  the  direction 
cosine  matrix  differential  equation  (45:72): 

cp  =  cp  Gig  "Gin  cl  (2-2) 

where : 

is  a  skew  symmetric  matrix  of  angular  velocity  of  the 
platform  (in  platform  coordinates  as  measured  by  rate  gyros). 

is  the  skew-symmetric  matrix  form  of  the  angular 
velocity  of  the  ("navigation")  local-level  frame  in  inertial 
space,  and  Cp  is  the  direction  cosine  transformation  matrix 
from  the  platform  to  the  navigation  frame. 

A  barometric  altimeter  is  used  to  aid  the  INS  by 
controlling  the  unstable  INS  errors  in  the  vertical  channel. 
The  INS  has  a  position  growth  error  of  approximately  0.8 
NM/hr  RMS  due  to  Schuler  effects,  instrument  errors  (input 
axis  misalignments,  instrument  biases,  drifts,  and  scale 
factor  errors),  and  environmental  errors  (gravity 
uncertainities  and  pressure  variations). 
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i  The 

following  equations  represent  the  mechanization 

i  equations 

that  are  in  the  INS  computer  to  determine 

velocity 

»  ~ 

|  and  position  (45:10-17): 

• 

A  =  ve/ (Rx  +  h) cos  L 

(2-3) 

•\  .*  * 

| 

P 

L  =  VN/ (RL+h) 

(2-4) 

► 

\ 

h  -  v2  -  Kl(h  -  href) 

(2-5) 

1 

B 

vx  =  fx  +  gx  -  (wy  -  Hy)vz  +  (w2  +iiz)V' 

t  (2-6) 

1 

• 

Vy  =  fy  +  gy  -  <WZ  +  ^Z)VX  +  Wjj  V, 

(2-7) 

i 

. 

• 

vz  =  fz  +  gz  “  WX  Vy  +  (wy  +ny)Vx 

—  K2  (h  —  hj.ef)  —  5a 

(2-8) 

:  t< 

»■ 

Ve  =  Vxcos  a  -  Vy  sin  or 

(2-9) 

i 

• 

Vn  =  Vx  sina  +  Vy  coso 

(2-10) 

1 

*  =  -ve  tan  L/R 

(2-11) 

\ 

=  K3  (h  -  href) 

(2-12) 

1 

| 

where, 

:  A  = 

longitude 

L  = 

1 

geographic  latitude 

l 

h  = 

INS  indicated  altitude 

V-..' 

vx' 

v  ,  V„  =  velocity  in  wander  azimuth  frame 
y  z 

, 

Vn  =  east  and  north  velocities 

L 

* 
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or  =  wander  azimuth  angle:  (angle  between  local- 
level  axes  and  wander  azimuth  horizontal  axes) : 
a  is  the  clockwise  rotation  of  X,Y,Z  from  E,N,U 
about  the  vertical  axis 

6a=  best  estimate  of  acceleration  error  due  to 
accelerometer  and  gravity  errors  based  on 
altimeter  input 

^x,y,z  =  specific  forces  in  wander  azimuth  frame 

cfx,y,z  =  gravity  components  in  wander  azimuth  frame 

href  =  baro-altimeter  indicated  altitude  (see  truth 
state  35) 

, k2  » K3  =  damping  loop  gains  of  vertical  channel  third- 
order  damping  of  INS  vertical  channel  with 
baro-al time ter) 

!)y(Z  =  components  of  earth  angular  velocity  in  wander 
1  !  “  azimuth  frame  (x  is  orthogonal  to  P.  ) 

Rx  L  =  east-west/north-south  radius  of  curvature  of 
'  the  earth  reference  ellipsoid  (9) 

wx,y,z  =  an9ular  velocity  of  wander  azimuth  frame  with 
respect  to  inertial  space. 


These  equations  could  then  be  reproduced  in  computer  software 
to  compute  position  and  velocity  in  the  wander  azimuth  frame. 
From  these  equations,  the  following  basic  INS  error  equations 
are  derived  wrt  the  east,  north,  up  (ENU)  frame.  By  fixing 
alpha  (o)  in  Eqs  (2-9)  and  (2-10)  to  -90  degrees  referenced 
from  north,  the  following  solutions  are  found: 


Ve  =  Vx  (2-13) 


VN  =  Vy  (2-14) 

These  solutions  can  then  be  substituted  into  Eqs  (2-3)  thru 
(2-8)  and  the  appropriate  attitude  error  equations  (45:26)  to 


produce  the  following  results: 


<JA=  (pz/cos  L)  6L  -  (pN/R  cos  L)  5h  +  5Ve/R  cos  L  (2-15) 


6L  =  (pe/R) 6h  +  dVN/R 

<5h  =  dvz  -  K^h 

(5Ve  =  (2(i2nvn  ♦  Qzvz)  *  pn  Vn  COS2  L) <5l 
+  (pnPe  +  pnKz^h  “  (Petan  L  +  Kz)dVe 
+  (w2  +  Q z ^ vn  -  (wn  +  ^n^vz  +  ^e  + 


(2-16) 


(2-17) 


(2-18) 


<5Vn  =  -(2i2n  Ve  +  pn  Ve  cos2L)dL 

+  ^pnpz  ”  PeRz^^  ~  2wz  ^ve  ~  ^z 
+  Pe  6VZ  +  (5fn  +  ign 
6wz  =  -2  Qz  Ve  <5L  -  p2  ♦  p2)(5h 


(2-19) 


+  2wn  ^Ve  -  2pe  dvn  +  dfz  +  6 gz  -  K2  $h 


(2-20) 


«e  =  (-pe/R)«h  -  dVn/R  +  wz  €n  -  wn  6 z  +  <Jw6 


(2-21) 


€n  =  ~  ~  (Pn/R)^h  +  ^Ve/R  “  wz€e  +  we€z  +  dwn  <2*22) 

ez  =  (wn  +  pn  tan  L)  -  (pz/R)dh 


+  (tan  L/R ) 6Ve  +  wn£e  +  iw5 


(2-23) 


<ia  =  Kj  dh  =  Kj  (h  —  hreg) 


(2-24) 


'*«  •*.  **,  •*.  ^ •" .  •' .  •*.  •* 
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where : 


Ce  n  z  =  Platform  misalignment  angles  (see  (45:193-195) 
for  an  explanation  of  transformation  to  E-N-U 
frame) 

6 fe  n  z  =  accelerometer  errors,  as  transformed  to  E-N-U 
frame  (gravity  knowledge  errors  are  not 
explicitly  modeled) 

iw„  „  „  =  gyroscope  errors,  as  transformed  into  ENU 

“/**/“  r- 

frame 

pp  „  ,  =  angular  velocity  of  ENU  frame  w.r.t.  earth 
6,n'Z  (45:12) 

5h  =  altitude  errors,  where  h  and  href  were 
previously  defined. 


Other  errors  and  their  equations  are  gyroscope  errors, 
gravity  uncertainties,  baro-al timeter  errors,  satellite 
positioning  system  receiver  errors,  terrain  correlation 
errors,  radar  altimeter  errors,  and  Doppler  radar  errors. 
Components  of  these  errors  are  modeled  as  random  constants, 
random  walks,  and  first-order  Markov  processes. 

A  random  constant  is  modeled  as  the  output  of  an 
integrator  with  zero  input  and  a  (Gaussian)  random  initial 
condition  which  has  a  zero  mean  and  a  variance,  P  .  This 
type  of  model  is  suitable  for  describing  an  instrument  bias 
that  changes  each  time  the  device  is  turned  on,  but  remains 
constant  while  it  is  on. 

A  random  walk  is  the  output  of  an  integrator  driven  by 
zero-mean,  white,  Gaussian  noise.  The  defining  equations  are 
given  below: 


x(t)  =  w{t)  ,  x ( t pi )  =  0 


(2-25) 


/.  r.  ' 


•  •  •  •  *  ■  >  «,  •  «  . 


E  (w  ( t )  )  =0 


E  [ w ( t )  w(t  +  r  )  ]  =  Q  «(T) 


E  [x2  (t)  ]  =  Q  (t  -  tn) 


(2-26) 


(2-27) 


(2-28) 


where  Q  is  the  strength  of  the  white  Gaussian  noise  and  «(r) 
is  the  Dirac  delta  function.  The  random  walk  is  suitable  for 
describing  errors  that  grow  without  bound  or  are  slowly 
varying  (a  pseudonoise  driver  addition  to  a  random  constant 
integrator  model) . 

A  first-order  Markov  process  is  the  output  of  a  first- 
order  lag  driven  by  a  zero-mean,  white,  Gaussian  noise  of 
strength,  Q.  The  model  is  described  by  the  following 


equations : 


X(t)  =  (-1/T)  x  (t)  +  w ( t ) 


E  [x ( t ) 2 ]  =  Q  T/2 


where : 


Q  =  2<72/T 


<7=(E  [xU)2])3* 


(2-29) 


(2-30) 


(2-31) 


(2-32) 


T  =  correlation  time 


A  first-order  Markov  model  is  used  to  represent  the 
exponentially  time-correlated  noises.  The  autocorrelation 
kernel  function  for  this  process  is  (24:178): 


E  [x(t)  x(t  +  r  )  ]  =  <r2e 


2„- |T|  /T 


(2-33) 


■7 


where , 

a  and  T  are  defined  above 
t  =  time  interval 

All  modeled  errors  are  assumed  to  be  independent  (45:20) 
with  initial  covariances  described  by: 

Pij(O)  =  0,  i  ^  j  (2-34) 

pii  (°)  =  Xi2  (2-35) 

where  is  the  initial  condition  on  the  standard  deviation 
of  the  i*-*1  truth  state  at  time  tg  . 

The  gyroscope  errors  ( 4 5 : 75-1 01 ; 9 )  are  gyro  drift  (g- 
insensitive,  g-sensitive  and  g^-sensitive) ,  scale  factor 
errors,  and  input  axis  misalignments. 

G-insensitive  gyro  drift  exhibits  growth  in  time.  It  is 
modeled  by  a  random  walk  for  each  gyro  and  is  one  of  the  most 
significant  error  sources  for  the  INS.  G-sensitive  drift 
produces  a  gyro  output  drift  which  is  proportional  to  the 
specific  force  and  is  applied  to  each  gyroscope.  The  g- 
sensitive  drift  is  modeled  by  a  random  constant  coefficient 
which  is  multiplied  by  the  appropriate  component  of  actual 
specific  force.  G2-sensitive  gyro  drifts  are  the  result  of 
anisoelastic  torques  and  are  also  modeled  by  random  constants 
and  coefficients  which  are  then  multiplied  by  products  of  two 
appropriate  components  of  true  specific  force.  For  the 


purposes  of  this  research,  gyro  drift  will  be  modeled  as  a 
random  constant  and  a  random  walk  to  account  for  the  gyro 


drift  errors;  i.e.  g-sensitive  and  g^-sensitive  components 
are  not  explicitly  modeled. 

Gyro  scale  factor  errors  and  misalignment  are  the  result 
of  the  error  occurring  from  the  measured  voltage  being 
translated  to  a  torque  reading  and  installation  errors.  The 
scale  factor  error  is  modeled  as  a  random  constant.  The  six 
misalignment  angles  are  due  to  the  three  gyros  being 
displaced  into  directions  about  the  rotational  axis. 

The  gyro  drift  model  is  shown  in  the  following  equations 
(one  equation  for  each  platform  axis) : 


ex 

II 

D 

X 

Hi 

+  wicy 

XGy 

+  wicz 

XGZ 

+  wicx  GSFX 

(2-36) 

>1 

=  °Yf 

+  wicx 

YGX 

+  wicz 

YGz 

+  wicy  ^SFy 

(2-37) 

€  z 

=  DZf 

+  wicx 

ZGX 

+  wicy 

ZGy 

+  wicz  GSFz 

(2-38) 

where , 

cx,y,z  =  total  error  along  x,y,z  axes 

DXf,DYf,  DZf  ~  gyro  drift  rate  bias  error  (see  Table  I) 

wicx,y,  z  =  computer  frame  angular  rate  w.r.t.  inertial 
space 

X,Y,ZGx  y  z  =  gyro  input  axis  misalignment  (see  Table  I) 
GSFXfyfZ  =  gyro  scale  factor  errors 

Fig.  2.1  represents  the  typical  model  for  gyro  errors  in  the 
X-sensitive  direction. 

Accelerometer  errors  (45: 105-118;9)  are  modeled  as  input 
axis  misalignment,  scale  factor  error,  and  biases. 


There  are  six  accelerometer  misalignment  angles  which 
follow  the  same  argument  as  gyro  misalignment.  Each 
misalignment  angle  is  modeled  as  a  random  constant. 

Accelerometer  biases  induce  a  constant  force  measurement 

error  and  are  adequately  modeled  by  random  walks.  Scale 
factor  errors  are  the  result  of  translating  voltage  to 
specific  force  readings  and  each  is  modeled  as  a  random 
constant  since  the  scale  factor  is  assumed  linear  over  the 
operating  range  of  the  accelerometer. 

The  total  accelerometer  error  model  is  shown  in  the 
equations  below: 

«AX  =  ABx  +  fx  ASFX  +  fy  XAy  +  fz  XAZ  (2-39) 

«Ay  =  ABy  +  fy  ASFy  +  fx  YAX  +  fz  YAZ  (2-40) 

4AZ  =  ABZ  +  fz  ASFZ  +  fx  ZAX  +  fy  ZAy  (2-41) 

where : 

iAx,y,z  =  total  error  in  x,y,z  direction 
ABV  „  ,  =  accelerometer  bias  error  (see  Table  I) 

A  f  X  f  £. 

^x,y,z  =  specific  force  in  x,y,z  direction 

ASFV  „  _  =  accelerometer  scale  factor  error  (see  Table  I) 
a  /  y  /  2 

X,Y,ZAV  v  _  =  accelerometer  misalignment  error  (see 
X,y,Z  Table  I) 

The  total  error  model  for  x  axis  accelerometer  errors  is 
shown  in  Fig.  2.2. 

Gravity  errors  are  not  explicitly  modeled.  The  gravity 
errors  are  typically  generated  by  using  a  reference  ellipsoid 
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for  the  specific  force  computations.  This  modeling  fails  to 
account  for  the  geoidal  local  variations  which  produce  an 
acceleration  error  in  the  three  axes.  Gravity  modeling 
requires  modeling  these  local  variations  and  correcting 
acceleration  error  for  the  gravity  modeling  error.  This  error 
does  not  represent  a  serious  correction  until  one  is 
interested  in  generating  a  .25  NM/hr  or  better  INS.  For  this 
reason,  gravity  errors  are  not  modeled  for  this  research. 

Baro  altimeter  error  (15:3-46)  is  represented  as  a 
single  state  model  which  accounts  for  calibration  and 
reference  bias,  weather  variations,  and  static  pressure  error 
changes  with  airspeed.  This  bias  model  is  modeled  as  a 
first-order  Markov  process  to  account  for  isobaric  variations 
which  have  constant  correlation  distances  and  thus  much  lower 
correlation  times  for  high-performance  aircraft,  letting  the 
"correlation  time"  be  the  correlation  distance  divided  by 
vehicle  velocity. 

The  barometric-altimeter  error  model  is  shown  in  the 
equation  below: 


epo  -  (-Volts’  eP°  *  Wlt) 


(2-42) 


where , 


epo  is  the  error  due  to  variation  in  altitude  of  a 
constant  pressure  surface 

Vg  is  the  ground  velocity  of  the  aircraft 

Dalts  t*ie  correlation  distance 

w(t)  is  the  white  noise  driving  process 
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Fig.  2.3.  Baro-Altimeter  Error  Model 


The  GPS  satellite  positioning  system  is  modeled  under 
the  assumptions  that  the  satellite  clocks  are  synchronized 
(and  periodically  updated  from  ground  stations)  and  operate 
with  negligible  error,  and  tranmissions  are  accurate.  With 
these  assumptions,  satellite  positioning  errors  can  be 
attributed  to  the  user  receiver  clock  alone.  The  clock  error 
is  the  sum  of  four  processes  (15:09-15);  initial  phase  error 
accounts  for  the  actual  difference  between  the  user  clock  and 
the  master  clock;  initial  frequency  offset  errors  refer  to 
the  difference  in  frequency  between  the  user  and  master  clock 
immediately  after  synchronization;  long  term  stability  errors 
are  used  to  account  for  crystal  aging;  random  errors  account 
for  short-term  stability  errors,  temperature  variations,  and 
vibration-induced  errors. 


The  clock  errors  are  established  along  three  orthogonal 
axes  such  that  no  clock  errors  are  shared  between  any  two 
axes,  i.e.,  such  that  error  ellipsoids  are  perfectly 
spherical  (this  implies  a  particularly  convenient  orientation 
of  the  satellites  w.r.t.  the  navigation  frame  and  it  is 
assumed  that  satellite  selection  algorithms  will  produce 
results  similar  to  this  performance).  Since  clock  errors  are 
established  in  both  phase  (position)  and  frequency 
(velocity),  these  errors  will  be  used  to  correct  INS  errors 
in  both  position  and  velocity.  The  measurement  model  takes 
both  position  and  velocity  measurements. 

The  satellite  positioning  system  error  model  is  shown  in 
the  equation  below: 


dtbu  +  atru  + 


(2-43) 


where , 

<*tu  is  the  total  phase  (position)  error 
«t£u  is  the  frequency  bias 

<tru  is  the  random  frequency  error  (modeled  as 
first-order  Markov) 

w^(t)  is  the  white  noise  process. 


Doppler  radar  is  modeled  to  compensate  for  errors  in 
beam  direction,  temperature,  installation  alignment,  INS 
attitude,  tracker  time  constant,  surface  motion,  and 
beamwidth  (15:3-32-40).  Under  the  assumption  that  Doppler 
errors  are  dominated  by  al ignment/ pitch  calibration  errors 
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and  scale  factor  errors,  these  errors  will  be  explicitly 
represented  in  the  "truth"  model  (15:3-40-42).  This 
simplification  is  also  possible  due  to  the  restriction  to 
overland  flight  which  eliminates  the  surface  motion  errors. 
The  alignment/pitch  calibration  errors  will  be  modeled  as 
random  constants,  and  the  scale  factor  errors  will  be  modeled 
as  first-order  Markov  processes  (15:3-35-37). 

The  Doppler  radar  error  model  is  shown  in  the  following 
equations : 


V  b 
XX 


+  4V, 

sx 


(2-44) 
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(2-45) 


^Du  =  ^ubu  + 


,vDh  =  vh  bh  +  8Vsh 

where , 

*VD  is  the  total  Doppler  velocity  error 

V  is  the  along-track,  cross-track,  and  vertical 
velocity 

iVg  is  the  scale  factor  error 


(2-46) 


Radar  altimeter  errors  are  typically  modeled  as  two 
errors  (15:3-46-47).  The  largest  errors  in  using  this  as  an 
altitude  reference  are  the  zero  offset  and  scale  factor. 
Both  of  these  errors  are  modeled  as  random  constants.  This 
model  does  not  account  for  terrain  variation  effects  since  no 
actual  data  for  ground  characteristics  are  available. 


'  l»'J  Wm  ^  I" 


Terrain  correlator  errors  can  be  modeled  as  map  errors. 
These  errors  are  modeled  with  a  5-state  "shaping  filter". 
Three  states  account  for  errors  in  north,  east  and  vertical. 
The  other  two  states  are  north  and  east  velocity  errors.  The 
velocity  errors  are  modeled  as  random  constants  with 
pseudonoise  addition.  The  positional  errors  for  horizontal 
are  driven  by  the  velocity  states  with  a  random  constant. 
The  vertical  position  error  is  modeled  as  a  random  constant 
and  a  pseudonoise. 

The  terrain  correlation  system  is  modeled  by  the 
following  equation: 

iP  =  iV  +  w ( t )  (2-48) 

«A  =  wz(t)  (2-49) 

where, 

iP  represents  the  east  and  north  position  errors 

av  represents  the  east  and  north  velocity  errors 

w(t)  is  a  white  noise  process  for  east  and  north 
velocity. 

aA  is  the  vertical  position  error 
wz(t)  is  the  vertical  white  noise  process 
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The  52-state  variables  are  summarized  with  their  initial 


conditions  in  Table  I.  The  Fundamental  Matrix,  F(t),  is 
represented  by  Figures  2.1  -  2.5.  A  list  of  error  source 
initial  values  and  statistics  is  shown  in  Table  III.  The 
initial  conditions  are  representative  of  a  medium-grade 
strapdown  INS. 

Table  I 

Error  Model  State  Variables 


State  Variable 

Basic  Inertial  Navigation  Errors 

1.  A 

east  longitude  error 

2.  <5L 

north  latitude  error 

3.  ih 

altitude  error 

4.  iVe 

east  velocity  error 

5.  «V„ 

north  velocity  error 

6.  6WZ 

vertical  velocity  error 

7.  €e 

east  attitude  error 

S.  €n 

north  attitude  error 

9*  €Z 

vertical  attitude  error 

Vertical 

Channel  Error  Variable 

Initial  Condition 
(Standard  Deviation) 


05  arc  min 
05  arc  min 
30  ft 
1  ft/sec 
1  ft/sec 
1  ft/sec 
05  arc  min 
05  arc  min 
4  arc  min 


10.  da  vertical  acceleration 
error 


006  ft/sec 


Table  I 


(cont ' d) 


State  Variable 


Gvro  Drift 


TE:  This  drift  is  an  approxi¬ 

mation  to  account  for 
g-insensitive ,  g-sensitive 
and  g^-sensitive 
errors . 

DXf  x  gyro  drift 

DYf  Y  gyro  drift 

DZf  z  gyro  drift 

Gvro  Scale  Factor  Error 


Initial  Condition 
(Standard  Deviation) 


14.  GSFX 

X 

gyro 

scale 

factor 

15.  GSFy 

Y 

gyro 

scale 

factor 

16.  GSFZ 

Z 

gyro 

scale 

factor 

Gyro  Input 

Axis 

Misalignment 

17.  XGy 

X 

gyro 

about 

Y 

18.  XGZ 

X 

gyro 

about 

Z 

19.  YGX 

Y 

gyro 

about 

X 

20.  YGZ 

Y 

gyro 

about 

z 

21.  ZGX 

Z 

gyro 

about 

X 

22.  ZGy 

Z 

gyro 

about 

Y 

Accelerometer  Biases 

23.  ABX 

X 

accelerometer 

bias 

24.  AB„ 

Y 

accelerometer 

bias 

. 008°/hr 
.  008°/hr 
.  008°/hr 

2  ppm 
2  ppm 
2  ppm 

5  arc  sec 
5  arc  sec 
5  arc  sec 
5  arc  sec 
5  arc  sec 
5  arc  sec 


Table  I.  (cont'd) 


State  Variable 


25.  ABZ  z  accelerometer  bias 


Initial  Condition 
(Standard  Deviation) 


Accelerometer  Scale  Factor  Error 


26.  ASFX  X  accel  scale  factor 

27.  ASFy  Y  accel  scale  factor 

28.  ASFZ  Z  accel  scale  factor 


60  ppm 
60  ppm 
60  ppm 


Gravity  Uncertainties 


NOTE: 

Gravity  uncertainties  are 
not  modeled  due  to  medium 
accuracy  INS 

Accelerometer 

Misali< 

Input  Axis 
?nment 

29.  XAy 

X 

accel 

about  Y 

30.  XAZ 

X 

accel 

about  Z 

31.  YAX 

Y 

accel 

about  X 

32.  YAZ 

Y 

accel 

about  Z 

33.  ZAX 

Z 

accel 

about  X 

34.  ZAy 

Z 

accel 

about  Y 

Barometer 

Altimeter  Error 

35.  e  error  due  to  variation 
in  altitude  of  a 
constant  pressure 
surface 


NOTE:  X,Y,Z  are  for 

platform  not  wander 
azimuth  frame 

10  arc  sec 

7  arc  sec 

10  arc  sec 

7  arc  sec 

10  arc  sec 

10  arc  sec 


500  ft 


Table  I.  (cont'd) 


State  Variable 

Initial  Conditions 
(Standard  Deviation) 

Satellite 

Positioning  System  Error 

36. 

itu 

clock  phase  bias 

1000  ft 

37. 

itu 

clock  frequency  error 

1  ft/sec 

38. 

•  • 

fltu 

clock  aging  bias 

2  x  10-7  ft/sec^ 

39. 

^tRu 

clock  frequency  bias 

10  ft/sec 

Doppler  Radar  System  Errors 

40. 

6BU 

longitudinal  beam  error 

2  arc  min 

41. 

6bk 

latitude  beam  error 

2  arc  min 

42. 

6Bh 

vertical  beam  error 

2  arc  min 

43. 

^vsp 

along-track  scale  factor 

.3  ft/sec 

44. 

*vs, 

across-track  scale 
factor 

.3  ft/sec 

• 

ID 

ivsh 

vertical  scale  factor 

.3  ft/sec 

Radar  Mtimeter  System  Error 

46. 

^zo 

zero  offset  error 

2  ft 

47. 

dV 

scale  factor 

.025 

Terrain  Correlation  Errors 

48. 

6  E 

easting  map  error 

320  ft 

49. 

iN 

northing  map  error 

320  ft 

50. 

6a 

vertical  map  error 

98  ft 

51. 

ive 

east  velocity  error 

2  ft/sec 

52. 

avn 

north  velocity  error 

2  ft/sec 

XDOT  (1)  =  F9x9  (1) *XS (2) +F9x9  (7) *XS (3) +  F9x9 (16) *XS (4) 

XDOT  (2)  =  F9x9  ( 8 ) *XS ( 3 ) +F9x9 ( 22 ) *XS ( 5 ) 

XDOT  (3)  =  F9x9  (9)  *XS  (3) +XS  (6) +CK1*XS  (35) 

XDOT  (4)  =  F9x9  (2)  *XS  (2)  +F9x9  (10)  *XS  (3)  +F9x9  (17)  *XS  (4) 

+  F9x9  (23)  *XS  (5)  +F9x9  (28) *XS (6)  +F9x9  (34)  *XS  (8) 

+F9x9 (38) *XS(9) 

+CNP ( 1 ) *XS ( 23 ) +CNP ( 4 ) *XS (24) +CNP (7) *XS  (25) 

+CNP (1) *FX*XS (26) +CNP (4) *FY*XS (27) +CNP(7) *FZ*XS  (28) 
-CNP(l) *FZ*XS (29) +CNP (1) *FY*XS (30) +CNP (4) *FZ*XS (31) 
-CNP ( 4 ) *FX*XS ( 320-CNP ( 7 ) *FY*XS (33) +CNP(7) *FX*XS(34) 
XDOT  (5)  =  F9x9  ( 3 ) *XS ( 2 ) +F9x9 ( 11) *XS ( 3 ) +F9x9 ( 18 ) *XS ( 4 ) 

+F9x9 (24) *XS ( 5 ) +F9x9 (29) *XS (6) +F9x9 ( 30 ) *XS ( 7 ) 

+F9x9 (39) *XS(9) 

+CNP(2) *XS (23) +CNP (5) *XS (24) +CNP (8) *XS  (25) 

+CNP (2) *FX*XS (26) +CNP ( 5 ) *FY*XS (27) +CNP ( 8 ) *FZ*XS ( 28 ) 
-CNP (2)*FZ*XS(29) +CNP (2) *FY*XS (30) +CNP (5) *FZ*XS ( 3 1 ) 
-CNP (5) *FX*XS (32) -CNP (8) *FY*XS (33) +CNP(8) *FX*XS (34) 
XDOT  (6)  =  F9x9  ( 4 ) *XS ( 2 ) +F9x9 ( 12 ) *XS  ( 3 ) +F9x9  ( 19 ) *XS  ( 4 ) 

+F9x9 (25) *XS (5) +F9x9 (31) *XS(7) +F9x9 (35) *XS ( 8 ) -XS ( 10 ) 
+CNP ( 3 ) *XS ( 23 ) +CNP ( 6 ) *XS (24) +CNP(9) *XS (25) 

+CNP ( 3 ) *FX*XS ( 26 ) +CNP(6) *FY*XS(27) +CNP (9) *FZ*XS (28) 
-CNP (3) *FZ*XS (29) +CNP (3)*FY*XS(30) +CNP (6) *FZ*XS (31) 
-CNP (6) *FX*XS (32) -CNP (9) *FY*XS ( 33 ) +CNP ( 9 ) *FX*XS (34) 
+CK2*XS (35) 

XDOT  (7)  =  F9x9  (13)  *XS  (3)  +F9x9  (26)  *XS  (5)  +F9x9  (36)  *XS  (8) 

+F9x9 (40) *XS(9) 

+CNP ( 1 ) *XS(11) +CNP (4) *XS ( 12 ) +CNP ( 7 ) *XS (13) 

+CNP ( 1 ) *WCX*XS (14) +CNP (4) *WCY*XS ( 15 ) +CNP ( 7) *WCZ*XS(16) 
+CNP ( 1 ) *WCZ  *SW (17) -CNP ( 1 ) *WCY*XS ( 18 ) -CNP ( 4 ) *WCZ  *XS ( 19 ) 
+CNP ( 4 ) *WCX*XS ( 20 ) +CNP ( 7 ) *WCY*XS (21) +CNP ( 7 ) *WCX*XS (22) 
XDOT  (8)  =  F9x9  (5)  *XS  (2) +F9x9  (14)  *XS  (3) +F9x9  (20)  *XS  (4) 

+F9x9 (32) *XS (7) +F9x9 (41) *XS (9) 

+CNP ( 2 ) *XS (11) +CNP ( 5 ) *XS ( 12 ) +CNP ( 8 ) *XS (13) 

+CNP ( 2 ) *WCX*XS ( 14 ) +CNP ( 5 ) *WCY*XS (15) +CNP(8) *WCZ*XS (16) 
+CNP ( 2 ) *WCZ*XS ( 17 ) -CNP ( 2 ) *WCY*XS ( 18 ) -CNP ( 5 ) *WCZ  *XS ( 19 ) 
+CNP ( 5 ) *WCX*XS ( 20 ) +CNP ( 8 ) *WCY*XS ( 21 ) -CNP ( 8 ) *WCX*XS (22) 
XDOT  (9)  =  F9x9(6)*XS(2)+F9x9(15)*XS(3)+F9x9(21)*XS(4) 

+F9x9 (33) *XS (7) +F9x9 (37) *XS  (8) 

+CNP (3) *XS (11) +CNP(6) *XS (12) +CNP(9) *XS (13) 

+CNP ( 3 ) *WCX*XS ( 14 ) +CNP ( 6 ) *WCY*XS (15) +CNP ( 9 ) *WCZ  *XS (16) 
+CNP ( 3 ) *WCZ*XS ( 17 ) -CNP ( 3 ) *WCY*XS ( 18 ) -CNP ( 6 ) *WCZ*XS ( 19 ) 
+CNP ( 6 ) *WCX*XS ( 20 ) +CNP ( 9 ) *WCY*XS (21) -CNP ( 9 ) *WCX*XS ( 22 ) 
XDOT  (10)  =  CK3*XS (3) -CK3*XS (35) 

XDOT  (11)  thru  XDOT  (34)  =  0 
XDOT  (35)  =  ( **V  / D aits  }  xs<35) 


Fig  2.9.  F^^  Partition  35  x  35  of  Fundamental  Matrix 


Table  II 


Notation  Used  in  Figure  2.9 


F9x9 (1) -F9x9 (41) 

Basic  9x9  non-zero  locations 
for  Fundamental  Matrix  (45:26) 
baro-al timeter  terms  added 

XS ( 1 ) -XS { 35 ) 

Error  states  1-35 

CK1,  CK2,  CK3 

baro-al timeter  damping 
coefficients 

CNP ( 1 ) -CNP ( 9 ) 

Direction  cosine  matrix  for 
transformation  from  platform 
to  navigation  frame 

Fx'  Fy»  Fz 

specific  forces 

WCX,  WCY ,  WCZ 

Angular  velocity  of  E-N-U 
frame  w.r.t.  inertial  space 

VDalts 

Aircraft  ground  speed/ 
correlation  distance 
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Table  III 


Error  Source  Statistics 


• 

Random  Walks  (x  =  w) 

State 

Variable 

Noise  Spectral  Density  (Q) 

11 

X  Gyro  Bias 

( .002 

°/HR) 2  /HR 

12 

Y  Gyro  Bias 

( .002 

°/HR) 2  /HR 

13 

Z  Gyro  Bias 

( .002 

°/HR) 2  /HR 

23 

X  Accel  Bias 

(3 

ug)2  /HR 

24 

Y  Accel  Bias 

(3 

ug)2  /HR 

25 

Z  Accel  Bias 

(3 

ug) 2  /HR 

36 

Clock  Phase  error 

(.2 

ft)2  /sec 

50 

Terrain  Vertical  Pos. 

Error  (30 

ft)2  /sec 

i 

51 

Terrain  East  Velocity 

Error  (1  ft/sec)2  /sec 

52 

Terrain  North  Velocity 

Error  (1  ft/sec)2  /sec 

First- 

-Order  Markov  Processes 

(x=- ( 1/t)x+w) 

Q=2  a  2  It 

value 

Correlation  Time 

35 

Baro-Altimeter  Error 

500  ft 

(500  nautical 
miles  )/vg 

39 

Clock  Random  Frequency 

10  ft/sec 

(7200  sec) 

43 

Doppler  along-track 
Scale  Factor  Error 

(Vx) 5xl0-4f t/sec  (900  sec) 

44 

Doppler  across-track 
Scale  Factor  Error 

(Vy ) 5xl0“^f t/sec  (900  sec) 

45 

Doppler  Vertical  Scale 
Factor  Error 

(Vz) 5xl0“^f t/sec  (900  sec) 

Simulation 


The  results  obtained  in  this  effort  were  generated  using 
the  SOFE  (36)  Monte  Carlo  evaluation,  PROFGEN  (35)  flight 
profile  generator,  and  SOFEPL  (37)  sample  statistics 
generation  and  plotting  software  packages. 

Flight  Trajectory 

The  flight  trajectory  is  generated  with  the  AFAL  program 
PROFGEN  and  stored  on  magnetic  tape.  Table  IV  demonstrates 
the  characteristics  of  the  flight  trajectory  (e.g.,  takeoff, 
climbout,  dive,  jinking  (tactical  manuever,  etc.).  It  is  a 
7236  second  high-performance  aircraft  flight  profile  with 
many  dynamic  manuevers.  This  profile  was  chosen  to  be 
representative  of  regions  of  benign  dynamics  and  harsh 
dynamics  to  test  the  ultimate  robustness  of  the  FDI  system. 
Fig.'s  2.13  thru  2.17  demonstrate  the  flight  characteristics. 


Table  IV 


Flight  Profile  Statistics 


Segment 

Number 

Duration 

Seconds 

Manuever 

Acceleration 

Roll 

Pitch 

Heading 

1 

30 

STRT 

0.0  grav 

0.0 

0.0 

0.0 

2 

20 

VERT 

.250 

0.0 

10.00 

0.0 

3 

205 

VERT 

.050 

0.0 

26.00 

0.0 

4 

85 

VERT 

.250 

0.0 

-36.00 

0.0 

5 

942 

STRT 

0.0 

0.0 

0.0 

0.0 

6 

11 

VERT 

1.573 

0.0 

1.70 

0.0 

7 

16 

VERT 

3.071 

0.0 

-19.90 

0.0 

8 

4 

VERT 

4.212 

0.0 

18.20 

0.0 

9 

37 

HORZ 

.200 

0.0 

0.0 

14.10 

10 

439 

STRT 

0.0 

0.0 

0.0 

0.0 

11 

345 

VERT 

.0358 

0.0 

-10.0 

0.0 

12 

66 

VERT 

.197 

0.0 

10.0 

0.0 

13 

91 

JINK 

8.528 

0.0 

13.0 

30.00 

14 

319 

HORZ 

.200 

0.0 

0.0 

90.00 

15 

29 

VERT 

3.000 

0.0 

13.20 

0.0 

16 

10 

VERT 

4.000 

0.0 

-45.40 

0.0 

17 

2 

ROLL 

0.0 

113.40 

0.0 

0.0 

18 

2 

ROLL 

0.0 

113.40 

0.0 

0.0 

19 

21 

VERT 

6.000 

0.0 

53.90 

0.0 

20 

18 

VERT 

1.278 

0.0 

-21.70 

0.0 

21 

40 

JINK 

9.258 

0.0 

20.00 

45.30 

22 

20 

VERT 

4.000 

0.0 

10.50 

0.0 

23 

10 

VERT 

3.000 

0.0 

-20.60 

0.0 

24 

30 

HORZ 

2.000 

0.0 

0.0 

85.00 

25 

10 

VERT 

5.000 

0.0 

10.10 

0.0 

26 

61 

VERT 

5.000 

0.0 

15.00 

0.0 

27 

20 

ROLL 

0.0 

78.80 

0.0 

0.0 

28 

10 

ROLL 

0.0 

-78.80 

0.0 

0.0 

29 

50 

VERT 

3.000 

0.0 

-15.00 

0.0 

30 

1863 

STRT 

0.0 

0.0 

0.0 

0.0 

31 

45 

VERT 

.500 

0.0 

15.50 

0.0 

32 

25 

VERT 

.500 

0.0 

-15.50 

0.0 

33 

5 

ROLL 

0.0 

50.90 

0.0 

0.0 

34 

5 

ROLL 

0.0 

-50.90 

0.0 

0.0 

35 

1493 

HORZ 

.500 

0.0 

0.0 

11.20 

36 

527 

STRT 

6 

0.0 

C.O 

0.0 

37 

300 

VERT 

.500 

0.0 

-6.90 

0.0 

38 

30 

VERT 

.050 

0.0 

6.90 

0.0 

Monte  Carlo  Analysis 

The  results  obtained  were  generated  from  10  runs  of 
SOFE.  Each  run  produced  a  different  sequence  of  random 
numbers  to  generate  the  samples  of  input  white  noise 
processes.  Sample  statistics  were  computed  for  each  time 
point  using  the  equations: 

N 

£  =  (l/N)  E  x^  (2-50) 

i  =  l 

2  N 

a  =  (1/N-D  L  x±2  -  (N/N-l)  x2  (2-51) 

i  =  l 


where , 

x  is  an  estimate  of  the  mean  of  x, 

<7  2  is  an  estimate  of  the  variance  of  x,; 

N  is  the  number  of  computer  runs. 

Ten  runs  were  chosen  to  reduce  the  variations  in  the  computed 
standard  deviations  in  the  computed  standard  deviations  of 
the  samples  for  x^  below  an  acceptable  value.  This  produces 
an  essentially  unbiased  estimate  of  the  state's  standard 
deviation  (37:8). 

The  Unaided  Simulation 

The  position,  velocity,  and  attitude  errors  for  this 
unaided  INS  are  shown  in  Fig.'s  2.18  thru  2.27.  These  plots 
represent  the  magnitude  of  errors  that  would  be  seen  if  a 
tactical  aircraft's  INS  were  operating  in  an  unaided  mode 
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(except  for  the  baro-al timeter  which  provides  vertical 
channel  stability).  These  plots  represent  a  minimum 
performance  bound  against  which  to  evaluate  the  filter's 
performance. 

The  performance  plots  also  verify  the  desired  values 
expected  for  this  medium  accuracy  INS.  Also  evident  in  the 
plots  are  the  effects  of  Schuler  frequency  and  aircraft 
manuevering. 

The  unaided  simulation  serves  as  a  means  of  validating 
the  truth  model  states.  In  Chapter  Three,  a  reduced  order 
model  (derived  from  the  truth  model)  is  generated. 
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Longitude  Error  For  Unaided  INS 


TIME  I  SECONDS ) 


iOjS/IJ J  nbOIIbjA  bObbj  ^JA 
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iQ.0  5500. 0  6000. 0  651 


.  0  5000 .  0  5500 . 0  6000 . 0  6500 . 0  / 


f SECONDS) 


.  0  2500 . 0  .5000 . 0  .5500 . 0  4000 . 0  4500 . 0  5000 . 0  5500 . 0  6000  0  6500  0  7000  .  0  7500 . 0 

TIME  f SECONDS) 


III.  The  Filter  Design 


Introduction 

Typical  Kalman  filter  design  is  an  iterative  process. 
The  design  is  based  on  incorporating  modifications  and 
evaluating  any  such  modifications  to  determine  the 
performance  capability  of  the  resulting  filter.  Performance 
requirements  such  as  reaching  specified  RMS  errors,  and 
constraints  such  as  cost,  sequencing,  storage,  and 
computation  time,  play  a  major  role  in  the  design  decision 
process . 

The  design  of  such  a  filter  would  be  typically 
structured  into  the  following  pattern: 

(1)  Develop  a  "truth"  model  as  the  best,  all  inclusive 
representation  of  the  real  world. 

(2)  Propose  a  Kalman  filter  design  based  on  the  "truth" 
model . 

(3)  Reduce  the  order  of  the  system  model  assumed  in  the 
filter  and  incorporate  any  other  purposeful  simplifications 
such  as  ignoring  small  matrix  coefficients,  etc. 

(4)  Conduct  a  covariance  analysis  and  "tune"  the  filter; 
iterate  back  to  step  3  as  required. 

(5)  Perform  a  Monte  Carlo  analysis  on  best  designs. 

(6)  Study  the  pe r f or mance / 1 oad ing  trade-offs  and 


implementation  requirements. 


(7)  Implement  the  final  design  on  onboard  computer. 

(8)  Perform  checkout,  final  tuning,  and  testing. 

The  filter  proposed  in  this  study  is  based  on  a  26-state 
model  derived  from  the  52-state  "truth"  model  of  the  previous 
chapter.  It  is  composed  of  the  basic  9-state  Pinson-Widnal 1 
(45)  error  model  for  the  basic  INS  errors  plus  the  following 
additional  states: 

Table  V 

Additional  Filter  Error  States 


Model  States 

No.  of  States 

Vertical  Acceleration  Error 
(needed  for  3rd  order  vertical 
channel  damping  for  the  INS) 

1 

Gyro  Drift 

3 

Accelerometer  Bias 

3 

Baro-Altimeter  (error  due  to  the 
variation  in  altitude  of  a 
constant  pressure  surface 

1 

Doppler  radar  (1  -scale  factor 
and  1-bias) 

2 

Radar  Altimeter  (1-zero  offset 
and  1-scale  factor) 

2 

Terrain  Correlator  (1  for  each 
position  error  state) 

3 

Satellite  Positioning  (1-position 
and  1-velocity) 

2 

The  effects  of  the  unmodeled  states  from  the  "truth" 
model  were  incorporated  into  the  appropriate  states  in  the 


filter  by  increasing  the  strength  of  the  associated  white 
noise  inputs  or  by  changing  the  physical  process  as  required 
(e.g.,  a  first-order  Markov  process  with  a  long  correlation 
time  may  be  somewhat  appropriately  modeled  as  a  random  walk 
and  incorporated  into  another  state) . 

The  basic,  driving  consideration  for  the  design  of  this 
filter  model  is  the  conceptual  study  of  an  FDI  system.  The 
filter  was  generated  to  provide  the  FDI  system  with  a  cross- 
section  of  sensor  error  states  to  examine  the  effects  of 
different  failure  modes  on  the  overall  filter  and  also 
examine  the  FDI  system  itself. 

The  remainder  of  this  chapter  provides  an  overview  of 
the  error  modeling  for  the  various  sensors  and  also  displays 
the  specific  error  model  for  each  sensor  incorporated  into 
the  filter. 

The  Baro-Altimeter 

The  baro-al timeter  operates  by  measuring  atmospheric 
pressure  and  then  scaling  the  output  to  obtain  the  proper 
exponential  altitude  versus  pressure  relation.  The  error 
sources  which  affect  barometric  measurements  are  attributable 
to  turbulence  and  pressure  drops  at  the  static  pressure  vent, 
temperature  variations,  and  low-pressure  gradients.  Since 
the  atmospheric  pressure  decreases  exponentially  with 
altitude,  the  accuracy  of  the  altimeter  is  greatly  reduced 
above  20,000  feet.  Horizontal  weather  fronts  can  also  induce 


errors  in  the  barometric  altimeter 


The  error  model  for  the  barometric  altimeter  can  be 


characteristically  generated  as  a  random  bias  for 


calibration,  reference,  weather  changes,  and  static  pressure 


changes.  The  bias  modeling  of  weather  changes  and  static 


pressure  is  appropriate  if  the  aircraft  has  a  slow  ground 


speed  for  the  correlation  distance,  which  produces  a  large 


time  constant;  however,  for  this  particular  application,  the 


changes  would  be  more  appropriately  modeled  (45:3-46)  as  a 


first-order  Markov  process  with  a  correlation  distance  of  500 


nautical  miles  to  model  isobaric  variations  on  the  order  of 


500  feet.  The  altimeter  lagging  effect  is  not  modeled  in  the 


filter.  For  the  purposes  of  this  research,  the  baro- 


altimeter  is  primarly  utilized  as  a  measurement  device  at 


constant  altitude  to  support  the  terrain  correlator.  Because 


of  the  constant  altitude  criteria,  lagging  effect  can  be 


ignored.  The  model  utilized  for  this  study  is  given  in  the 


following  equation: 


<-VDalts  ]  eP°  +  w 


(3-1) 


where. 


V  =  velocity  w.r.t.  ground  in  ft/sec 


correlation  distance  (500  n.m.) 


w  =  white  noise  process 


E  [w]  =  0,  E  [w ( t )  w(t  + r  )]  =  Q 6(t) 


(3-2) 


Q  =  2<72/T  =  2  (500  ft)  2Vg/Dalts  =  1.6  Vg 


i 


•V-V'V< 


(3-3) 


For  this  particular  model,  the  total  error  contribution  to 
the  baro-error  process  is: 


*hB  =  epo  (3-4) 

The  measurement  process  is  given  as: 

hMEAS  =  htrue  +  epo  +  va  (3-5) 

where : 

v  represents  zero-mean,  white  Gaussian  measurement 
noise. 

Doppler  Radar 

Doppler  radar  is  used  to  provide  a  direct  measure  of 
aircraft  ground  speed.  The  relative  motion  between  the 
source  of  the  radar  beam  (e.g.,  the  aircraft)  and  the  target 
(e.g.,  the  ground)  causes  a  frequency  shift  in  the  reflected 
signal  which  is  proportional  to  the  velocity.  By 
transmitting  and  receiving  several  of  these  beams,  a 
simultaneous  measure  of  the  beams  will  provide  information 
about  vehicle  ground  speed  in  an  along-track,  cross-track, 
and  vertical  direction  (vertical  velocity  is  not  an  accurate 
quantity).  This  system  model  is  based  on  a  four-beam 
arrangement  (two  forward-looking  and  two  aft-looking).  The 
system  is  also  modeled  as  being  rigidly  attached  to  the 
aircraft.  The  signals  are  then  transformed  into  navigation 


coordinates  in  the  navigation  computer. 


Although  the  Doppler  output  is  not  actually  continuous 
(it  is  actually  a  pulse  train  of  several  pulses  per  second), 
it  is  modeled  as  a  continuous  system.  This  is  reasonable 
since  the  time  constants  of  the  navigation  system  errors  are 
much  longer  than  those  for  the  Doppler. 

There  are  several  sources  of  error  in  the  Doppler  radar 
system.  Fluctuation  noise  is  due  to  the  variations  in  the 
scatter  of  the  beam  due  to  terrain  (or  water  surface) 
characteristics.  These  errors  are  typically  modeled  as 
first-order  Markov  processes  in  the  along-track,  cross-track, 
and  vertical  directions  with  correlation  times  of  .25  to  1.0 
seconds  (45) . 

Beam  direction  errors  are  caused  by  misalignment  or 
post-calibration  uncertainty  in  antenna  direction,  refraction 
from  the  radome/aircraf t  boundary,  and  thermal  displacement 
of  the  antenna  elements.  These  errors  are  typically  modeled 
as  random  constants. 

Random  scale  factor  errors  are  due  to  aircraft  vibration 
and  ground  scattering  variations  with  terrain.  These  errors 
are  modeled  as  first-order  Markov  processes  with  a 
correlation  time  of  15  minutes  (45:3-36). 

The  Doppler  model  used  for  the  study  does  not  account 
for  over  water  errors  since  the  flight  profile  does  not  pass 
over  water. 

The  filter  model  is  a  two-state  model  which  accounts  for 
along-track  beam  direction  error  and  random  scale  factor 


errors.  These  errors  are  then  transformed  to  the  navigation 


frame  through  the  proper  direction  cosine  matrix.  This 
transformation  generates  a  portion  of  the  along-track  error 
in  the  east,  north,  and  up  direction. 


Fig.  3.0.  Vehicle  Track  To  Navigation 
Frame  Transformation 


To  go  from  an  X , 

u,  z  (along-track, 

cross-track. 

vertical)  frame  to  a  E,  N,  U  (east,  north,  up) 

the  following  set  of  equations: 

frame  requires 

6ve 

=  6Vk  cos  6  -  iVpsin 0 

(3-6) 

*vn 

=  5VX  sin  6  +  dV^cose 

(3-7) 

«vz 

N 

> 

•© 

II 

(3-8) 

where, 

^vx'u,z  =  vehicle  track  velocities 
dVe,n,z  =  navigation  frame  velocities 


7%  ^  ■  .  ■».  ■  v  ■  *  v  ■.»  ■  ■.  .■  * . 


©  =  angle  between  aircraft  heading  and 
navigation  frame. 


Since  the  error  model  for  the  Doppler 

for  6Vxr  then  the  above  equations  will 

radar  is  only  tracked 

simplify  to: 

<*Ve  =  <5vx  cos© 

(3-9) 

dvn  =  ^Vx  sin© 

(3-10) 

For  the  Doppler  model,  the  beam  direction  error  is  modeled  as 
a  random  constant: 

bx  =  0  (3-11) 

where, 

bx  is  the  along-track  beam  error  in  ARC  MlNutes. 

For  the  random  scale  factor  error,  a  first-order  Markov 
process  is  used  for  the  error  model  and  is  described  by  the 
following  equation: 

=  -Bs  *VS  ♦  w  (3-12) 

A  A  A 

where , 

dv  =  along-track  scale  factor  error 

*  x 

Bs  =  inverse  time  correlation  (T  =  900  secs) 
ws  is  the  white  noise  process  with  the  following 
statistics  (15)  : 

E  [ws  ]  =  0,  E  [ws  (t)ws  (t  +r)l  =  Q4(r)  (3-13) 

X  X  \ 


9 
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Q  =  2  ( KV .  )2/a 


(3-14) 


where : 

K  =  2  x  10"^  for  good  Doppler 
ot  =  .5  sec-1 

=  along-track  velocity 

The  total  error  model  for  the  Doppler  is  then: 

^VED  =  b a  COS  6  -  Vu  sln 


+  6VC  [cos  0] 
sa 


(3-15) 


iVNn  =  b.  [V,  sin  0  +  V  cos  0] 


+  dVG  [sin  0] 


(3-16) 


where: 


^VED,ND  =  Total  Doppler  error  for  the  navigation  frame 

Vx  =  along-track  velocity 

b^  =  beam  direction  error 

ivc  =  scale  factor  error 
SA 

0  =  angle  between  aircraft  heading  and 
navigation  frame. 


The  measurement  error  is  modeled  as: 


VE  =  VE (TRUE) 

+  <JvED 

+  vde 

(3 

-17) 

VN  =  VN (TRUE) 

+  dvND 

+  vdn 

(3 

-18) 

.*  ,*  ,*  »**  ,*  »“  "  .*  «*  ,*  ,*  «’  #*  .*  »*  •*  •*  ■*  •*  •  «*,  .  *  .*•*•*•'•*  » '  >  *  •  *  »  *  v"  ■_*  ».*  v'  k."  v* 

^  /*-•  ‘  '*/**  .*  /.*  'j  *-•  ’v  ’/  V  V  _V_  V  *•*  V-  »**-■*.  «*. 
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where: 


V  is  the  zero-mean,  white  Gaussian  measurement  noise 
Radar  Altimeter 

Radar  altimeters  measure  delay  between  transmission  of  a 
signal  and  the  reflection  of  the  signal  from  the  ground.  A 
radar  altimeter  has  an  inherent  accuracy  of  25  -  100  feet 
(15:3-45);  however,  an  unattractive  feature  of  the  radar 
altimeter  for  use  with  an  INS  is  that  vertical  distance  is 
given  relative  to  the  surface  topography  rather  than  the 
reference  ellipsoid.  The  direct  use  of  the  radar  altimeter 
will  not  stabilize  the  vertical  INS  channel  because  the  radar 
altimeter  errors  are  not  related  to  the  vertical  channel  INS 
errors.  The  radar  altimeter  "raw"  measurements  produce  a 
high  frequency  signal  of  varying  amplitude  due  to  the 
roughness  of  the  terrain.  This  high  frequency  data  is  usable 
by  the  INS  but  has  poor  quality  for  vertical  channel  damping. 
The  radar  altimeter  is  primarily  used  for  landing,  terminal 
guidance,  or  as  a  terrain  mapping  aid.  The  radar  altimeter 
used  in  this  study  is  used  as  part  of  the  terrain  correlation 
system. 

The  dominant  errors  for  the  radar  altimeter  are 
instrument  biases  and  scale  factor  variation.  Another 
potentially  large  error  source  is  from  interference  effects 
due  to  terrain  irregularities.  In  addition,  the  time 
distribution  of  the  returned  signals  within  the  beam  pattern 


-■  ;•  /•  :■ 
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cause  the  generation  of  an  average  for  the  terrain  height 
over  the  beam  area. 

The  simplified  error  model  (15:3-46)  which  accounts  for 
the  scale  factor  errors  and  bias  is  given  below: 

y=  0  (3-19) 

where: 

y  is  the  scale  factor  error 

*hzo  =  0  (3-20) 

where : 

flh2Q  is  the  zero  offset  error 

These  errors  are  then  combined  into  the  total  radar  altimeter 
error  model  in  the  following  equation: 

^RA  =  y  hgn  +  ^zo  (3-21) 

where, 

ihRA  is  the  total  error 
hgn  =  altitude  above  ground 
y and  ihzo  were  previously  defined. 

The  measurement  process  is  given  by  the  following  equation: 

hMEAS  =  hTRUE  +  ^  hRA  +  vra  (3-22) 

where: 

v  represents  zero-mean,  white  Gaussian  measurement 
noise. 


Since  this  particular  error  model  does  not  have  any 
noise  added  to  account  for  measurement  uncertainty,  a 
pseudonoise  will  be  added  to  account  for  finite  word  length 
and  roundoff  errors  associated  with  the  airborne  computer. 
It  is  also  needed  to  prevent  filter  divergence. 

Map  Correlator 

Map  correlation  techniques  involve  the  comparison  of 
real-time  measurements  of  earth  surface  properties  with  a 
computer  stored  map.  A  position-fix  is  then  made  when  an 
"in-tolerance"  match  is  made  between  the  measurement  data  and 
the  map.  The  actual  measurement  may  be  "active"  (e.g., 
radar)  or  "passive"  (resulting  from  natural  phenomena).  For 
this  study,  the  radar  altimeter  is  used  as  a  measurement 
device. 

The  actual  measurement  process  utilizes  measurements 
from  the  radar  altimeter  and  the  baro-altimeter  to  provide  a 
vehicle  altitude  reference  above  the  terrain.  The  irregular 
features  of  the  terrain  generates  a  topographic  signature 
which  is  then  compared  to  the  prestored  map. 

The  error  modeling  for  this  terrain  correlator  is 
accomplished  by  assuming  errors  are  appropriately  tracked  as 
random  walks  for  the  three  position  error  states  with  the 
appropriate  initial  conditions  (45).  The  model  for  terrain 
correlation  errors  is  given  in  the  following  equations: 


where, 

dE,N,A  are  the  terrain  correlation  errors  for  east, 
north,  and  vertical  position. 

we,n,z  are  wJlite  noise  processes. 


where: 


E  [w]  =  0,  E  [ w ( t )  w  ( t  +  t  )  ]  =  Q  6  (r)  (3-26) 

The  strength  of  the  white  noise  process,  Q,  is  computed  based 
on  the  maximum  error  in  velocity  in  the  three  coordinates. 
The  equation  for  Q  is: 

Q  *  (<JVE,avN,  dVz>max)  2/ (  (21  min)  (60  sec/min)  )  (3-27) 

where: 

iVE'*vN'*vz,max  represents  the  maximum  velocity  error 

21  minutes  represents  the  time  to  quarter  wavelength 
of  the  Schuler  frequency. 

The  measurement  process  for  this  error  model  is: 

EMEAS  =  ETRUE  +  ^E  +  vce  (3-28) 

nMEAS  =  NTRUE  +  *N  +  vcn  (3-29) 


AMEAS  =  aTRUE  +  iA  +  vca 


(3-30) 


where: 


v  represents  zero-mean,  white  Gaussian  noise. 

Satellite  Position  System 

The  satellite  positioning  system  is  typically  modeled 
based  on  a  four  satellite  measurement  scenario.  Range  and 
range  rate  error  information  is  derived  from  a  pseudo-range 
measurement  (from  the  satellites),  and  an  estimated  pseudo¬ 
range  computed  from  the  INS-indicated  position,  and  the 
satellites'  position  and  motion.  The  observed  range  and 
range  rate  errors  are  a  measure  of  the  user's  position, 
velocity,  and  clock  errors.  Clock  errors  are  transformed  to 
distance  and  velocity  by  multiplying  the  clock  phase  error 
and  frequency  error  by  the  speed  of  light. 

Typically,  errors  in  both  satellite  ephemerides  and 
clock  errors  will  constitute  the  modeled  errors  for  the 
measurement  process.  Since  satellite  clock  synchronization 
errors  and  transmitted  navigation  data  errors  (transmitted 
periodically  from  ground  stations  to  the  satellites)  are 
assumed  negligible  when  compared  to  errors  from  the  user's 
clock,  only  user  clock  errors  will  be  modeled  in  this  study. 
The  clock  errors  are  also  not  affected  by  coordinate  frame 
transformation  since  the  errors  are  not  peculiar  to  any 
particular  orientation  of  the  receiver  (15:4-54).  Satellites 
are  always  assumed  chosen  such  that  resulting  even  ellipsoid 
in  GPS  position  information  is  essentially  spherical. 


The  filter  error  model  for  the  satellite  positioning 


system  (9:53)  is  given  in  the  equations  below: 


Stu  =  Wl 


(3-31) 


where , 

itu  =  clock  phase  error 
w i  =  white  noise  process 

E  [wx]  =  0,  E  [Wl(t)Wl(t  +  r ) ]  =  Q  i(r)  (3-32) 

Q  =  1  f t2/sec  (3-33) 

*tRu  =  (-1/T)  dtRU  +  w2  (3-34) 

where, 

itRu  =  clock  frequency  error 
T  =  7200  seconds 
w2  =  white  noise  process 

E  [w2]  =  0  E  [w2(t)  w2(t  +T)]  =  Q6(T) 

Q  =  2<r2/T  =  2(10  ft/sec)  2/7200  sec  =  .028  ft2/sec3  (3-35) 

As  can  be  seen  from  Eq  (73),  the  position  error  is  modeled  as 
a  random  walk  with  the  appropriate  initial  condition  and 
covariance.  The  velocity  error  is  modeled  as  a  first-order 
Gauss-Markov  process. 

The  measurement  process  is  modeled  as: 

ve(meas)  =  ve(true)  +  ^fcRu  +  vve 


(3-36) 


n(meas)  ~  vN(true)  OLRu  Vvn 
vz(meas)  =  vz(true)  +  ^fcRu  +  vvz 

and. 


'MEAS  =  ETRUE  + 

£tu  +  ve 

(3-39) 

(MEAS  =  NTRUE  + 

fifcu  +  vn 

(3-40) 

ZMEAS  "  ZTRUE  +  6tu  +  vz  (3-41) 

The  filter  model  is  summarized  in  Table  VI.  The 
standard  deviations  of  the  states  are  based  on  the  initial 
conditions  for  the  truth  model.  These  standard  deviations 
represent  the  filter's  own  measure  of  its  estimation 
uncertainty.  These  values  are  identical  to  the  initial 
conditions  seen  in  Table  II  except  for  states  24-26.  The 
increased  standard  deviations  are  primarily  due  to  the  lower 
dimensional  filter  model  and  the  increased  acquisition 
uncertainty  far  the  map  measurement  process. 

Gyro  and  Accelerometer 

The  reduction  in  the  number  of  states  from  the  "truth" 
model  for  the  basic  INS  to  the  filter  model  is  due  to  the 
elimination  of  18  gyro  and  accelerometer  error  states. 

The  gyro  error  states  for  misalignment  and  scale  factor 
were  eliminated  and  their  error  contribution  was  modeled  as  a 
white  noise  contribution  to  the  three  attitude  error  states 


in  the  filter 


Table  VI 


The  Filter  Error  Model 


State  Variable 

Initial  Condition 
(Standard  Deviation) 

Basic  Inertial  Navigation  Errors 

The  9-state  model  is  identical 

same  as  "truth"  model 

to  the  "truth"  model 

Vertical  Channel  Error  Variable 

10.  6a  vertical  acceleration 

.006  ft^/sec 

error 

Gyro  Drift  Error 

11.  DXf  x  gyro  drift 

.  008°/hr 

12.  DYf  Y  gyro  drift 

.  008°/hr 

13.  DZf  z  gyro  drift 

. 008°/hr 

Accelerometer  Bias 

14.  ABX  X  accelerometer  bias 

40pg 

15.  ABy  Y  accelerometer  bias 

40jjg 

16.  ABZ  Z  accelerometer  bias 

40jug 

Baro-Altimeter  Error 

17.  e  variation  in  altitude 

of  a  constant 

500  ft 

pressure  surface 
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Table  VI  (cont'd) 


State  Variable 

Initial  Condition 
(Standard  Deviation) 

Satellite  Positioning  Error 

18.  £tu  clock  phase  error 

1500  ft 

• 

19.  5tRu  clock  frequency  bias 

15  ft/sec 

Doppler  Radar  System  Error 

20.  b^  along-track  beam  error 

1.75  arc  min 

21.  6vs  along-track  scale 

^  factor  error 

.4  ft/sec 

Radar  Altimeter  System  Error 

22.  5hzo  zero  offset  error 

2.5  ft 

23.  y  scale  factor  error 

.045 

Terrain  Correlator  Errors 

24.  iE  east  map  error 

500  ft 

25.  dN  north  map  error 

300  ft 

26.  6a  altitude  error 

100  ft 

The  accelerometer  states  for  misalignment  and  scale 
factor  error  were  handled  in  the  same  manner  as  the  gyro 
error  states  except  that  the  noise  contributions  were  added 
to  the  filter's  velocity  states. 

Initial  noise  strengths  for  the  velocity  and  attitude 
states  were  calculated  by  taking  the  initial  covariance,  PQ, 


of  the  unmodeled  gyro  and  accelerometer  states  through  a 


direction  cosine  transformation.  This  transformation  takes 
the  initial  covariances  from  the  platform  to  the  navigation 
frame.  The  noise  strengths  are  a  benchnark  Q,  from  which 
final  tuning  of  the  filter  is  accomplished.  Final  noise 
strengths  are  given  in  Table  VII. 

Filter  Tuning 

The  tuning  for  the  filter  was  accomplished  by  an 
iterative  process.  The  dynamic  driving  noise  matrix,  Q,  and 
the  measurement  noise  matrix,  R,  were  adjusted  to  provide  a 
"tuned"  filter  which  is  usable  for  the  entire  mission  (e.g., 
during  periods  of  both  benign  and  highly  dynamic  behavior). 
This  type  of  tuning  approach  requires  the  filter  to 
overestimate  its  own  errors,  especially  in  benign  regions,  in 
order  to  "capture"  harsh  dynamic  behavior. 

The  tuning  process  for  the  terrain  correlator 
measurements  produced  poor  results.  The  longitude  and 
latitude  error  states  had  no  significant  error  reduction 
occur  as  a  result  of  the  measurements.  Also,  the  terrain 
correlator  error  states,  themselves,  showed  divergent 
behavior.  Even  after  repeated  attempts  at  adjustments  of  Q 
and  R,  no  improvement  occurred.  Because  of  this,  a  3-state 
"truth"  model  for  the  terrain  correlator  was  proposed.  This 
was  a  reasonable  solution  since  a  3-state  model  is  typical 
for  a  terrain  correlator  acquisition  filter  model.  This  3- 


state  "truth"  model  is  identical  in  structure  to  the  3-state 


Table  VII 

Q  Values  For  Filter  Tuning 


Filter  State 


Random  talks  and  Pseudonoise  (P) 


1 

Longitudinal  Error  (P) 

2 

Latitude  Error  (P) 

3 

Vertical  Position  Error 

(P) 

4 

East  Velocity  Error  (P) 

5 

North  Velocity  Error  (P) 

6 

Vertical  Velocity  Error 

(P) 

7 

East  Attitude  Error  (P) 

8 

North  Attitude  Error  (P) 

9 

Vertical  Attitude  Error 

(P) 

11 

x  Gyro  Drift 

12 

y  Gyro  Drift 

13 

z  Gyro  Drift 

14 

X  Accelerometer  Bias 

15 

Y  Accelerometer  Bias 

16 

Z  Accelerometer  Bias 

18 

Satellite  Clock  Phase  Error 

24 

East  Terrain  Correlator 

Error 

25 

North  Terrain  Correlator 

Error 

26 

Vertical  Terrain  Correlator  Error 

Q  (noise  strength) 


20  ft^/sec 
2  f 


.025 

f tz/sec 

.025 

f t2/sec3 

.025 

f t2/sec3 

.05  • 

ft2/ sec-3 

.001 

rad2/sec 

.001 

rad2/sec 

.002 

rad2/sec 

.002 

deg2/hr3 

.002 

deg2/hr3 

.002 

deg2/hr3 

3 

pg2/hr 

3 

Jjg2/hr 

3 

pg2/hr 

40000  ft2/sec 

50 

f t2/sec 

50 

f t2/sec 

10 

f  t^/sec 

Table  VII  (cont'd) 

Q  Values  For  Filter  Tuning 


First  Order  Markov  Processes  (x=Bx+w) 

N=2B  a  2 

Filter  State 

la  value 

Inverse 

Correlation  Time(B) 

17 

Barometric 
Altimeter  Error 

500  ft 

V/ (500nm) 

19 

Clock  Frequency 
Error 

10  ft/sec 

1/ (7200  sec) 

21 

Doppler  Scale 
Factor  Error 

.3  ft/sec 

1/ (900  sec) 

filter  model.  Initial  conditions  for  the  "truth"  model  are 
identical  to  the  filter's. 

During  the  retuning  of  this  new  terrain  correlator  truth 
model  and  the  subsequent  measurement  simulation,  a  divergent 
condition  still  existed  in  the  longitudinal  and  latitude 
error  states.  This  was  eliminated  by  adding  a  "pseudonoise" 
to  these  states.  This  added  uncertainty  in  the  positional 
error  states,  in  effect,  allowed  the  benefits  of  the  external 
aiding  device  (the  terrain  correlator),  to  improve  the 
knowledge  of  the  positional  error  states  and  generated  a 
convergent  or  bounded  filter. 

The  final  Q  values  for  the  filter  are  shown  in  Table 
VII.  The  results  of  the  tuning  are  shown  in  Figures  3.1  thru 
3.26.  These  figures  are  plotted  for  the  true  mean  +  one  sigma,  super¬ 
imposed  on  the  filter-computed  0+one  sigma  ( - )  .  The  measurement 

process  begins  at  360  seconds. 


JSO.'J  400  0  400.9 


-SO  3  400  0  450.0  500.0 


atellite  Position  Error  For  Satellite  Measurement 


atellite  Velocity  Error  r'or  Satellite  Measurement 


iirror  i''o 


DS 1 


^'or  Do 


G'Gbfc  G  OC' 


Leal  Velocity 


o 


Doppler  Beam  Error  For  Doppler  Measurement 


iJdS/idJ  bGbbd  ciCi  Jbd  j^bJS  bd^ddCC 


3-36 


Doppler  Dcale  1'actor  Error  Eor  Doppler  Leasurement 


Terrain  Correlator  ioeasurement 


■aln  Correlator 


North  Velocity  Error  For  Terrain  Correlator  f.easureri. 


irror  t'o 


iiadar  Altimeter  Error  t' or  Terrain  Correlator  «:easu 


East  Terrain  Correlator  Position  Error  Por  Terrain  Correlator  iv.easurement 


For  Terrain  Correlator  measure 


errain  Correlator  Position  Error  For  Terrain  Correlato 


Background 


The  basis  for  many  FDI  systems  lies  in  the  generation  of 
a  filter  model  which  represents  some  "real  world"  set  of 
equations.  The  filter  model  is  usually  a  scaled-down  version 
of  a  larger,  more  inclusive  and  accurate  "truth"  model 
because  of  the  necessity  to  conserve  computer  memory  in  an 
on-board  computer.  The  most  common  form  of  filter  model  is 
usually  a  linear  set  of  state  equations.  The  linearization 
of  the  typically  non-linear  "real  world"  description  has  been 
performed  about  some  nominal  set  of  parameters  which  typify 
an  acceptable  operating  condition.  The  formulation  of  the 
Kalman  filter  represents  the  best  set  of  filter  equations 
based  on  such  a  linear  model.  The  prior  statement  is  factual 
since  the  filter's  performance  is  statistically  better  than 
any  other  type  of  linear  filter  construction,  and  it  is 
superior  to  nonlinear  forms  as  well  if  all  uncertainties  can 
be  described  as  Gaussian  processes. 

In  order  to  establish  the  quantities  which  are  the 
essential  inputs  to  the  FDI  system  from  the  operational 
navigation  Kalman  filter,  a  brief  description  of  the 
equations  which  are  the  basis  for,  and  describe,  this  filter 
are  essential.  The  system  dynamics  equation  which  describes 
any  general  state  in  the  real  world  is  assumed  to  be  a  linear 
stochastic  equation  of  the  form 


x(k  +  1)  =  0  (k)  x(k)  +  B { k )  u(k)  +  w(k) 


(4-1) 


where 

x(k)  =  real  world  description  of  x  at  time  k 
0(k)  =  state  transition  matrix 
B(k)  =  input  gain  matrix 
u(k)  =  input  quantities 

w(k)  =  zero-mean,  white,  Gaussian  noise  with  statistics 

E [w (k) ]  =  0  E[w(k)2]  =  Q (k)  (4-2) 

The  sensor  equation  for  the  filter  which  describes  the 
measurement  process  is: 

z(k)  =  H (k)  x (k)  +  J (k)  u(k)  +  v(k)  (4-3) 

where 

z(k)  =  measurement  of  state  x(k) 

H (k)  =  measurement  matrix 
J(k)  =  input  gain  matrix 

v(k)  =  a  zero-mean,  white,  Gaussian  noise  process 
independent  of  w(k),  with  statistics: 

E  [v  (k)  ]  =0  E(v(k)2]  =  R  (k)  (4-4) 

If  there  are  no  failures  in  the  system,  the  optimal  Kalman 
filter  state  estimator  is  described  by  the  following  set  of 
discrete  equations: 

8(k  +  1/k)  =  0  (k)  Sc  (k/k)  +  B(k)  u(k)  (4-5) 


x  (k/k)  =  8(k/k  -  1)  +  K  (k)  y(k) 


(4-6) 


y(k)  =  z (k)  -  H(k)  x (k/k  -  1)  -  J(k)  u(k)  (4-7) 

where  7  is  the  zero-mean,  Gaussian  residual  and  the  gain  K(k) 
is  calculated  from: 

P  (k  +  1/k)  =  0(k)  P  (k/k)  0T(k)  +  Q(k)  (4-8) 

V (k)  =  H (k)  P (k/k  -  1)  HT(k)  +  R(k)  (4-9) 

K (k)  =  P (k/k  -  1)  HT(k)  V*1(k)  (4-10) 

P (k/k)  =  P (k/k  -  1)  -K (k)  H(k)  P(k/k  -  1)  (4-11) 

where 

P(k/k  -  1)  is  the  estimation  error  covariance  of  state 
estimate  x(k/k  -  1) 

P(k/k)  is  the  corresponding  error  covariance  of  £(k/k) 

V (k)  is  the  covariance  of  7  (k) 

The  above  equations  represent  the  "normal  mode"  filter  (i.e., 
the  filter  is  operating  with  no-failure  parameters) . 

Failure  Detection  Concept 

Sensor  failure  detection  is  concerned  with  the  detection 
of  changes  in  the  system.  As  was  stated  in  Chapter  II,  the 
failure  of  a  sensor  is  usually  manifested  as  an  abrupt  change 
in  the  H  matrix,  increases  in  measurement  noise,  or  as  biases 
in  the  measurement  process  equation. 
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All  FDI  logic  is  based  on  a  comparison  of  actual  system 
output  quantities  and  some  established  values  which  represent 
either  an  acceptable  value  or  a  failure  declaration  bound. 
These  reference  values  are  usually  predetermined  based  on 
preset  constants,  historical  averages  of  output,  related 
sensor  output,  or  the  outputs  of  dynamically  related  models 
(14:2).  Outputs  which  are  compared  to  these  pre-established 
values  are  derived  from  actual  measurements,  state  and 
parameter  estimates  based  on  these  measurements,  or  various 
statistical  measures  such  as  variance  or  variance  ratios. 

The  level  of  the  malfunction  caused  by  a  particular 
failure,  in  effect,  categorizes  that  failure.  "Soft"  faults 
result  from  small  changes  in  the  system  characteristics  and 
are  interpreted  as  degraded  system  performance;  however,  the 
overall  system  performance  does  not  change  significantly. 
Examples  of  soft  failures  are  increased  sensor  bias  or 
measurement  noise.  Hard  failures  are  large  in  magnitude  and 
affect  system  performance  significantly.  Examples  of  such 
failures  are  computer  hardware  failure  and  gimbal  lock. 
Combinations  of  hard  and  soft  type  failures  are  composite 
failures  or  "mid"  failures  (14:8). 

As  was  previously  stated,  sensor  faults  are  manifested 
in  H,  the  measurement  matrix,  or  in  increased  bias  or 
measurement  noise  in  the  measurement  process  equation. 
Sensor  failures  reduce  the  observability  of  the  system  (as 
measured  by  eigenvalues  of  observability  Gramian).  This  may 


degrade  mission  effectiveness  without  any  effect  on 
controllability.  An  example  would  be  radar  failure  which 
would  cause  poor  navigation  accuracy  without  affecting  the 
closed-loop  aircraft  response. 

Observability  Criteria 

Observability  from  a  certain  set  of  measurement  devices 
can  be  determined  mathematically.  One  observability  test  for 
instrumentation  involves  the  0  (state  transition)  matrix  and 
the  H  (measurement)  matrix.  This  test  is  described  by  the 
following  equation: 

0  =  rank  [H T,0T  HT,  (0T)  2  HT,...,  (0T)  N_1  HT]  (4-12) 


where 


Og  represents  the  dimensionality  of  the  observable 
subspace  for  all  measurements  represented  in  H.  Any 
variation  of  o_  with  changes  in  H  indicates  the  effects 
of  faults  on  tne  observable  subspace.  (Notes  this  test 
is  only  for  time-invariant  systems). 


Detectability  Criteria 

Detectability  refers  to  the  ability  to  distinguish 
between  no-failure  and  failed  conditions  based  on  measured 
output.  Faults  are  detectable  if  the  statistics  of  the 
output  under  failed  conditions  are  statistically  different 
from  the  no-failure  outputs.  Detectability  of  a  faulty 
condition  does  not  imply  that  one  sensor  fault  can 
necessarily  be  distinguished  from  another. 
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Fault  Isolation 

Fault  isolatability  refers  to  the  FDI  system's  ability 
to  distinguish,  based  on  the  output  measurements,  among  the 
faulty  conditions  which  may  occur  in  the  system.  Any  two 
faults  can  be  distinguished  from  each  other  if  they  are 
statistically  different  from  each  other  in  their  effect  on 
sensor  outputs. 


FDI  Technique  Review 

There  are  three  major  components  of  an  FDI  approach: 

(1)  Type  of  statistical  technique  used 

(2)  Modeling  requirements 

(3)  Computer  implementation 

The  statistical  technique  should  provide  an  acceptable  degree 
of  detection  and  isolation  delay,  and  acceptable  false/ missed 
alarm  probabilities,  yet  be  easy  to  implement.  Modeling 
requirements  are  determined  by  the  type  of  fault  which  must 
be  detected  and/or  identified  and  the  statistical  techniques 
used.  The  computer  implementation  should  consider  the 
question  of  whether  parallel  processing  is  available. 
Parallel  processing  would  be  desirable  as  would  the 
utilization  of  several  simple  steps  rather  than  a  few  complex 
steps  for  software  implementation. 


Stochastic  Failure  Detection 

Deterministic  methods  fail  to  differentiate  between 
random  disturbances  (noise)  and  true  system  faults. 


Stochastic  design  methods,  which  model  dynamic  noise 
(generated  by  sensor's  internal  hardware  and  external 
environment),  measurement  noise  (environmental  effects),  and 
modeling  errors  (usually  incorporated  into  the  appropriate 
noise  strengths)  are  necessary  modeling  features  to  generate 
acceptable  tradeoffs  between  missed/false  alarms  and 
detection  delay. 

Either  a  single  Kalman  filter  or  a  bank  of  Kalman 
filters  can  be  utilized  for  the  fault  detec tion/ iso lation 
process.  In  the  single  Kalman  filter,  the  states  and 
covariances  are  propagated  under  the  no-failure  condition. 
With  this  approach,  the  observed  characteristics  of  either 
the  filter  measurement  residuals  or  some  other  filter  outputs 
are  then  used  to  detect  and  isolate  failures.  This  technique 
was  used  in  early  developments  by  Mehra  and  Peschon  (31)  and 
was  further  redefined  by  Willsky,  Deyst,  and  Crawford  (50) 
and  Willsky  and  Jones  (49).  The  main  idea  of  this  approach 
is  that  the  internally  computed  statistics  of  the  Kalman 
Filter  will  be  different  from  the  true  observed  behavior  of 
residuals  or  other  variables  if  a  fault  occurs.  Banks  of 
Kalman  filters  were  first  proposed  by  Magill(21)  and 
Lainiotis  (19)  and  were  applied  by  Montgomery  (32)  for 
redundancy  management.  The  concept  is  basically  two-fold;  one 
Kalman  filter  is  propagated  for  the  no-failure  condition  and 
an  additional  Kalman  filter  is  propagated  for  each  of  the 
failed  states.  Deckert  and  Deyst  (11)  compute  the  likelihood 
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ratios  sequentially  in  what  is  referred  to  as  a  sequential 
probability  ratio  test  (SPRT) . 


I 


I# 


i 


The  SPRT 

A  typical  SPRT  is  generated  upon  the  basis  of  two 
hypotheses:  the  hypothesis  of  no-failure  (H0)  and  failure 
(H^ ) .  The  probability  ratio  is  defined  as: 


y  N<i>  =  Pj^jij/Hnj 

P  ( Yjq  ( i )  /H ) 


( 4-13a) 


where 

N  =  the  number  of  most  recent  measurements  to  be  used  (a 
moving  window) 


and  the  SPRT  yields  the  decisions: 


yNU)  >  A  ■  H0  is  correct 

yN(i)  <  B  =  is  correct  (4-13b) 

A  <  7N(i)  <  B  =  No  decision 

The  SPRT  overcomes  the  problem  of  not  being  able  to  decrease 

the  probability  of  false  alarm  and  the  probability  of  missed 

alarm  simultaneously.  This  is  accomplished  by  setting  the 
threshold  values  A  and  B  until  the  probabilities  of  missed 


and  false  alarm  are  minimized. 

The  SPRT  has  the  following  advantages  and  disadvantages 


Advantages 

(1)  If  there  are  only  a  few  simple  hypotheses  to  test, 
SPRT  is  attractive. 

(2)  Given  acceptable  probabilities  of  false  and  missed 
alarms  the  method  will  detect  faults  with  minimal  time 
delay,  if  the  a  priori  distributions  are  known  exactly. 


Disadvantages 

(1)  Thresholds  for  probability  of  false  and  missed 
alarms  are  difficult  to  select  because  of  the  complex 
distribution  functions. 

(2)  To  detect  faults  in  minimal  time,  many  SPRTs  must  be 
run  each  using  data  of  different  duration  (i.e.,  soft 
faults  require  long  duration  and  hard  faults  require 
short  duration). 

(3)  The  number  of  SPRTs  increase  as  the  square  of  the 
number  of  hypotheses  (very  large  if  there  are  unknown 
parameters)  . 


Voting  Systems 

The  process  of  fault  detection  and  isolation  using  like 
sensors  (3  or  more)  will  not  be  addressed  further  in  this 
thesis.  Without  system  hardware  redundancy  being  considered, 
the  only  possible  application  of  voting  for  the  system  under 
consideration  would  be  in  gyro  and  accelerometer  fault 
detection;  however,  this  must  be  ruled  out  since  the  three 
gyros  and  accelerometers  are  mounted  orthogonally  by 
assumption.  Because  of  the  orthogonality,  they  do  not 
measure  any  shared  component  of  attitude  or  acceleration 
which  would  be  a  necessary  requirement  for  voting.  Note, 
there  are  nonorthogona 1  4  and  6  gyro  and/or  accelerometer 
INSs  which  would  allow  such  voting. 


FDI  System  Design 

The  purpose  of  this  thesis  is  to  find  a  suitable  FDI 
system  to  incorporate  with  the  aided  navigation  system.  The 
FDI  system  must  meet  the  aforementioned  requirements  of 
simplicity,  accuracy,  and  speed.  All  of  the  process 
techniques  which  have  been  addressed  to  this  point  have 
advantages  and  disadvantages  when  measured  against  these 
requirements . 

Based  on  this  process  review  and  the  FDI  requirements, 
innovations  -  based  detection  systems  offer  the  greatest 
accuracy,  constrained  by  the  need  for  simplicity  and  speed 
(time  from  actual  failure  to  declaration)  (47:609). 

Since  a  navigation  system  does  not  necessarily  require 
the  rapid  detection/ isolation  accuracy  that  an  aircraft 
flight  control  system  requires  for  aircraft  survival,  a 
certain  delay  of  time-to-failure  declaration  can  be  tolerated 
without  endangering  the  aircraft  or  crew.  This  time-to- 
failure  declaration  allows  the  FDI  system  to  recover  in 
effect  from  harsh  dynamical  characteristics  caused  by  harsh 
maneuvers.  The  occurrence  of  a  harsh  maneuver  will  cause 
gyro  and  accelerometer  error  states  to  grow  at  a  significant 
rate  due  to  rotational  rates  about  the  IMU  axes.  These  error 
states  could  then,  themselves,  cause  thresholds  to  be 
surpassed  when  no  failure  has  occurred  or,  since  they  drive 
attitude  and  velocity  error  states,  cause  these  states  to 


incur  violation  of  thresholds.  Because  of  this,  a  time-to- 
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failure  parameter  would  prevent  inadvertent  threshold 
violation.  Consistent  surpassing  of  thresholds  would  indicate 
failure  whereas  transient  passage  would  not. 

Failure  Detection  System 

The  failure  detection  system  for  this  thesis  will 
utilize  likelihood  function  statistical  testing.  This 
technique  is  very  simple  to  implement  compared  to  various 
likelihood  ratio  tests.  The  likelihood  ratio  techniques 
addressed  in  this  thesis  require  additional  filter  states  to 
model  failed  conditions  which  can  result  in  a  large  number  of 
additional  states.  The  likelihood  function  only  utilizes 
information  which  is  readily  available  from  the  Kalman  filter 
as  part  of  its  no-failure  measurement/update  algorithms. 
This  makes  it  attractive  when  measured  against  the  desire  of 
accuracy,  speed,  and  ease  of  implementation.  Moreover, 
likelihood  ratios  must  be  established  for  each  hypothesized 
form  of  failure,  and  failures  of  a  different  form  can  go 
undetected. 

The  Kalman  filter  (designed  for  no-failure  operation) 
generates  outputs  in  the  form  of  estimates  of  certain 
quantities  in  the  system  dynamics.  When  these  values  are 
compared  to  measured  values  of  the  same  quantities,  error 
signals  (residuals)  are  generated.  These  residuals  can  then 
be  utilized  to  determine  if  the  system  is  operating  normally 
or  if  a  fault  has  occurred. 


A  likelihood  function  provides  one  way  of  making  a 
statistical  test  for  a  failure.  A  time-history  for  the  error 
signals  being  tracked  is  "windowed"  to  keep  the  likelihood 
function  computationally  tractable.  In  order  to  "window"  the 
residuals,  the  N  most  recent  values  are  examined  to  compare 
them  to  a  statistical  description  (in  effect,  approximating 
statistics  (ensemble  average)  with  temporal  averaging  (N- 
step))  of  their  values  assuming  no-failure  conditions.  This 
value  of  N  can  be  adjusted  to  maintain  reasonable  detection 
performance.  Use  of  a  single  sample  would  not  be  advisable 
since  single  samples  of  large  value  could  be  expected  due  to 
harsh  flight  dynamics,  large  noise  values  at  a  given  sample 
time,  etc.  This  could  generate  a  false  alarm  when  no  failure 
actually  exists.  On  the  other  hand,  too  large  a  value  of  N 
could  make  the  likelihood  function  "insensitive"  to  a  change 
and  no  failure  might  be  detected  when  a  failure  has  actually 
occurred.  Therefore,  an  (iterative)  adjustment  in  "window" 
size  is  necessary  during  the  design  process  to  establish 
acceptable  performance. 

The  formulation  of  the  likelihood  function  begins  with 
an  expression  for  the  joint  probability  density  function  for 
the  N  most  recent  residuals  based  on  the  past  residuals: 

P [e ( i) ,  e (i  -  1),...,  e(i  -  N  +  l)/e(i  -  N),...,e(l)] 

where  e(i)  is  a  residual  value  and  p(x/y)  is  the  conditional 
probability  of  the  variable  x,  conditioned  on  the  value  of  y. 


The  basis  for  this  conditional  density  is  found  in  estimation 
theory . 

Baye's  Rule  for  conditional  density  functions  is  given 
in  the  following  equation: 

p [a ,b/c]  =  p [a/b , c]  p[b/c]  (4-14) 

Applying  this  equation  to  the  residual  conditional  density 
function  produces 

p[e(i),e(i  -  1),...,  e (i  -  N  +  l)/e(i  -  N),...,e(l)] 

=  p[e(i)/e(i  -  1),...,  e(l)]  x 

P  (e  (i  -  1),...,  e  ( i  -  N  +  l)/e(i  -  N)  , . . ,  e  ( 1)  ]  (4-15) 

Applying  Baye's  Rule  repeatedly  to  the  last  density  function 
in  Eq ( 4-15 )  produces 

p[e(i),  e (i  -  1),...,  e(i  -  N  +  l)/e(i  -  N) , . . . ,  e(l)] 
i 

=  n  p[e(j)/e(j  -  1),...,  e ( 1 ) ]  (4-16) 

j=i-N+l 

This  equation  is  then  the  product  of  the  conditional 
densities  of  the  N  most  recent  residuals,  each  conditioned  on 
the  previous  time-history  of  residuals.  A  likelihood 
function  is  then  derived  which  is  the  natural  logarithm  of 
the  derived  conditional  density  as  given  by  Eq(4-16): 


LFN(i)  =  In  Cp [e  (i)  - - ,  e ( i-H+1 ) /e ( i-N) , - ,e ( 1) ] } 


Z  In  £p[e(j)/e(j-l) e(l)]}  (4-17) 

j  =i-N+l 


Under  the  assumption  that  the  residual  sequence  is  a  set  of 
independent,  zero-mean,  Gaussian  random  variables,  Eq(4-17) 
can  be  written  as 
i 

LFN(i)  =  ^  In  1 _  exp  [  (  —  l/2)e2  (j)  /  cr  2  (  j  )  ]  (4-18) 

j  =i-N+l  (2  n  ) 1//2  a  ( j ) 


Note:  the  use  of  e  in  this  development  assumes  that  e  is  a 

scalar  residual  out  of  many  possible  residuals 

where  cr  ( j )  is  the  filter  estimated  standard  deviation  of  the 


jth  sample  from  the  formulation 


o  z(j)  =  hA(j)  P  ( j  /  j  -  1)  h  (j)  +  R(j) 


:4-20) 


where 


h  =  measurement  matrix  row 


P”  =  propagated  filter  covariance 


R  =  measurement  noise  variance 


By  substituting  the  N  most  recent  residual  values  into  Eq(4- 
19)  the  likelihood  function  for  the  observed  data  is: 


LFN  (  i )  =  ( -N  /  2  )  In  (  2  rr  )  -  L  In  <r(j) 

j  =  i-N  +  l 


■1/2  Z  [e2(j)/  <7  2  ( j  )  ] 
j  =i-N  +  l 


4-21) 
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Since  the  residuals  from  the  Kalman  filter  generate  the 
likelihood  function,  then  each  of  the  densities  described  by 
Eq (4-17)  is  in  fact  a  Gaussian  density  with  the  following 


statistics : 


E[z(j)/e(j  -  1),...,  e(l)]  =  hT(j)x(j/j  -  1) 


(4-22) 


where 


hT  ( j )  is  the  measurement  matrix  row  corresponding  to  the 
scalar  residual  under  investigation 

x(j/j  -  1)  is  the  state  vector  before  measurement  update 


and  the  conditional  variance 


ECe2 ( j ) / e ( j  -  1),...,  e  ( 1 ) }  -  E2(e(j)/e(j  -  l),...,e(l)} 


=  n  ( j )  P  ( j / j  -  1)  h  (j)  +  R(j) 


[4-23) 


where 


h(j)  is  the  measurement  matrix  row  as  given  above 

P ( j / j  -  1)  is  the  filter  covariance  before  measurement 
update 

R  ( j )  =  measurement  noise  variance 


For  real-time  likelihood  function  generation,  the  N  most 
recent  residuals  and  filter  estimated  covariances  are  used. 
As  time  progresses,  the  next  residual  and  estimated 
covariance  are  brought  in  and  the  next  likelihood  function 
value  is  generated.  As  can  be  seen  in  Eq(4-21),  if  the 
squared  residual  becomes  consistently  larger  than  the 
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estimated  variance,  then  the  likelihood  function  will  become 
more  and  more  negative.  A  negative  threshold  level  that  the 
likelihood  function  should  not  surpass  can  then  be  determined 
(providing  satisfactory  performance).  A  failure  is  declared 
if  the  likelihood  function  becomes  consistently  more  negative 
than  this  threshold.  Another  aspect  to  failure  declaration 
is  a  time-to-f ailure-declaration  parameter  which  minimizes 
false  alarms  by  allowing  temporary  transient  behavior  (due  to 
harsh  maneuvers  and  other  phenomena)  to  die  out  over  the 
time-to-f ailure-declaration  window.  In  a  general  sense,  soft 
failures  would  be  handled  by  tight  thresholds  plus  a  time-to- 
f ailure-declaration  parameter  and  hard  failures  by  a  larger 
threshold  only. 

For  this  thesis,  measurements  are  being  made  as  shown  in 
Table  VIII. 


Table  VIII 

Measurement  Processing 


External  Aid 

#  of  measurements 

Satellite  Position 

3 

Satellite  Velocity 

3 

Doppler  Radar 

3 

Terrain  Correlator 

3 
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Each  of  the  measurements  produces  a  residual  which  is 
individually  tracked  (along  with  the  estimated  variance)  by 
its  own  likelihood  function.  After  the  desired  number  of 
residuals  and  associated  variances  are  stored,  i.e.,  at  time 
tN,  the  likelihood  function  is  initialized  and  likelihood 
function  tracking  can  begin.  In  order  to  minimize  computer 
loading  and  also  track  the  likelihood  functions,  an 
approximated  version  of  Eq(4-20)  is  employed: 

i 

LFA(i)  =  L  C  (-1/2)  [e2(j)/  <r2(j)n  (4-24) 

j  =  i-N+l 

A  failure  can  be  declared  if 

LFl(i)  <  -T  (4-25) 

where 

LF^(i)  is  the  ]ikelihood  value 

T  is  a  desired  threshold  (there  may  be  more  than  one 
value,  to  detect  both  hard  and  soft  failures) 

Eq ( 4-24)  can  be  rewritten  to  incorporate  the  threshold. 

i 

L  [e2  ( j ) /  a 2  ( j  )  ]  >  2T  (4-26) 

j  =i-N+l 

Initially,  each  of  the  measurement  devices  is  run 
against  the  flight  profile  using  a  Monte  Carlo  process  to 
generate  a  likelihood  function  baseline  for  normal  (no 
failure)  operation.  Once  the  baseline  likelihood  function 


has  been  identified  for  the  measurement  device,  various 
failures  (different  magnitudes  and  devices)  will  be  injected 
at  a  scheduled  time  to  study  their  effect  on  the  likelihood 
functions  over  the  identical  flight  profile.  When  the 
likelihood  function  characteristics  have  been  determined  for 
the  measurement  processes,  and  appropriate  thresholds  for  the 
no-failure  case  have  been  established,  the  characteristics  of 
the  failed  conditions  can  then  be  exploited  to  establish  the 
identification  process. 

The  failures  which  will  be  modeled  in  this  thesis  are 
characteristic  of  real  world  faults.  For  instance,  a  gyro 
failure  can  be  "soft",  modeled  to  portray  a  gyro  float  leak; 
a  "hard"  failure  can  be  used  to  simulate  electrical  failure 
or  bearing  failure.  It  is  also  useful  at  this  point  to 
distinguish  between  "hard-over"  failures  and  hard  failures 
(i.e.,  loss  of  signal  content).  A  hard-over  failure  is 
characterized  by  an  extremely  large  signal  which  is  abnormal 
for  the  particular  device.  Mathematically,  it  could  be 
modeled  as: 

z  =  Hx  +  v  +  b  (4-27) 

where  the  value  of  H  is  much  increased  over  the  normal  range 
of  operation  or  a  large  magnitude  bias  b  appears.  Eq(4-27) 
can  also  be  used  to  model  a  "hard"  failure  (loss  of  signal 
content)  in  which,  in  this  scalar  measurement  case,  H  is  set 
equal  to  zero  and  only  measurement  noise  remains  in  the 
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scalar  case.  Simulations  of  both  "soft"  and  "hard"  faults 
will  be  performed  (hard-over  failures  are  not  addressed). 
Soft  failures  of  the  various  sensors  will  be  accomplished  by 
generating  a  one-sigma  ramp  contribution  to  the  particular 
error  state  for  the  sensor  being  considered.  This  is 
mathematically  expressed  as 

x  =  crx  (4-28) 

where 

x  =  sensor  error  state 

ax  =  ramp/slope  chosen  to  be  the  initial  condition  of 
the  bias  error  state  per  second. 

Both  "hard"  failures  and  measurement  noise  increases  can  be 
modeled  by  using  the  measurement  equation  given  by  Eq(4-27). 
Hard  failures  for  a  particular  sensor  are  modeled  by  simply 
setting  the  appropriate  H  matrix  row  elements  equal  to  zero. 
The  resulting  measurement  would  then  only  have  a  measurement 
noise  contribution  from  that  particular  sensor.  Increases  in 
the  strength  of  measurement  noise  (see  Eq(4-27))  for  a 
particular  sensor  are  representative  of  jamming  or  other 
external  noise  increases  which  mask  the  desired  sensor 
signal.  The  effect  of  "hard-over"  failures,  modeled  by  the 
addition  of  a  bias,  b,  as  shown  in  Eq(4-27)  will  not  be 
simulated  in  this  thesis  due  to  time  constraints.  Table  IX 
gives  a  list  of  the  various  sensors,  the  type  of  fault,  and 
its  characterization. 
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Table  IX 


Sensor  Fault  Classification 


Sensor 

Type 

Fault 

Modeled 

Classification 

gyro 

float  leak 

soft 

gyro 

bearing  failure 

hard 

accelerometer 

quantization  fault 

soft 

accelerometer 

pendulum  lock 

hard 

satellite 
receiver  clock 

overheating 

soft 

satellite 
receiver  clock 

clock  failure 

hard 

Doppler 

frequency  drift 

soft 

Doppler 

beam  failure 

hard 

Radar  Altimeter 

gimballing  errors 

soft 

Radar  Altimeter 

beam  failure 

hard 

Bar 0- Altimeter 

calibration  drift 

soft 

Baro-Al time ter 

transducer  failure 

hard 

Table  X  gives  an  example  of  how  both  gyro  and 
accelerometer  bias  errors  affect  the  dynamic  motion  states, 
X1  _  x9'  i*e*»  position  errors,  velocity  errors,  and  tilts  in 
the  INS.  x n ,  x12,  and  X13  are  gyro  bias  states.  *23,  x24» 
and  x25  are  accelerometer  bias  states.  The  x's  in  the  table 
denote  how  the  various  states  are  coupled.  It  can  be  seen 
that  gyro  error  states  are  direct  drivers  on  the  attitude 


differential  equations  and  accelerometer  error  states  are 
drivers  on  the  velocity  differential  equations.  This  infers 
that  accelerometer  failures  should  be  noted  earlier  than  a 
gyro  failure  for  a  velocity  measurement  since  the 
accelerometer  failure  is  one  integration  from  velocity  and  a 
gyro  failure  is  two  integrations  away.  Of  course,  eventually 
such  errors  would  corrupt  all  INS  outputs.  The  structure 
of  the  measurement  residuals  has  an  impact  on  the  detection 
of  these  faults.  This  aspect  of  identification  will  be 
addressed  in  the  following  chapter. 

Table  X 

Gyro  and  Accelerometer  Error  Tracking 


X1  x2 

x3 

x4 

x5 

x6 

x7 

x8 

x9 

X11 

x12 

x13 

x23 

x24 

x25 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 

X 
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The  appropriate  likelihood  functions  should  react  to 
these  faults  by  having  an  increasingly  negative  value.  Once 
the  established  threshold  (whether  soft  or  hard  failure)  has 
been  surpassed,  a  failure  is  declared  and  the 
isolation/ identification  process  begins. 

The  Isolation/ Identification  Process 

The  isolation/identification  of  a  failed  sensor  is  more 
time  consuming  than  the  failure  detection  process.  The 
formulation  of  an  isolation/ identification  process  that  is 
rapid,  efficient,  and  as  fault-free  as  possible,  is  the 
ultimate  goal.  Some  of  the  statistical  data  which  will  be 
gathered  during  the  failure  process  will  aid  the 
isolation/identification  of  a  failed  sensor.  For  instance,  a 
gyro  failure  may  affect  only  two  of  the  three  velocity  error 
states  initially,  unlike  the  effects  of  any  other  failure, 
which  may  aid  isolation/ identification.  If  two  unlike 
sensors  (i.e.,  accelerometer  and  Doppler)  affect  identical 
states,  then  such  information  as  time  between  any  likelihood 
function  threshold  violations  and  magnitude  may  offer 
information  which  will  aid  the  isolation/ identification 
process.  These  various  features,  which  should  become  evident 
during  failure  simulation,  will  be  exploited  if  it  is 
feasible. 


The  isolation/ identification  process  to  be  implemented 
in  this  thesis  will  be  based  on  information  gathered  during 


the  failure  simulation.  Each  failure  will  have  the  following 
information  gathered  from  it: 

(1)  Which  likelihood  functions  violated  thresholds 

(2)  The  order  of  likelihood  function  threshold  violation 
(time  of  failure) 

(3)  Magnitude  of  likelihood  functions  (growth  after 
failure  declaration) 

(4)  Magnitudes  of  other  likelihood  functions  which  may 
be  large,  but  not  past  their  thresholds. 

With  this  information  in  hand,  an  isolation/ identification 
algorithm  will  be  developed,  implemented,  and  tested.  The 
actual  formulation  for  the  isolation/identification  processor 
will  appear  in  Chapter  5.  It  will  be  exercised  against  the 
same  flight  profile  as  was  used  for  the  failure  simulation. 
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FDI  Analysis 


Simulation  Overview 

The  formulation  of  an  effective  isolation/ identification 
algorithm  can  rely  on  many  characteristic  of  the  likelihood 
function  over  the  time  duration  of  the  residual  tracking  pro¬ 
cess.  Certain  characteristics  of  the  likelihood  function  such 
as  the  time-of- failure  declaration  (with  respect  to  the  time  of 
threshold  passage  of  other  likelihood  functions  for  the  same 
measurement  process)  after  a  failure  is  simulated,  magnitude 
of  the  likelihood  function  value,  and  the  rate  of  growth  of 
the  likelihood  function  due  to  the  failure  (i.e.,  the  nega¬ 
tive  slope  characteristics  of  the  likelihood  function  after  a 
simulated  failure)  can  all  aid  the  development  of  a  suitable 
isolation  algorithm  for  the  particular  application. 

The  initial  data  gathered  for  this  isolation  algorithm 
development  consisted  of  the  simulation  of  a  specific  set  of 
failures  (hard  and  soft)  for  each  of  the  measurement  processes 
(satellite,  Doppler,  and  terrain  correlator).  The  likelihood 
functions  for  each  of  the  simulated  failures  were  then  analyzed 
for  specific  characteristics  to  establish  a  suitable  basis  for 
an  isolation  processor. 

Tables  XII  thru  XV,  to  be  presented  subsequently  in  this 
chapter,  demonstrate  the  results  achieved  by  the  likelihood 
function  detectors  with  magnitude  singled  out  as  the  primary 
parameter  for  failure  declaration.  The  failures  were  simulated 
in  both  benign  (straight  and  level)  flight  and  dynamic  (hard 
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dive,  jinking,  turns,  etc.)  flight  environments.  Furthermore, 
time  histories  of  actual  likelihood  functions  are  used  to  dis¬ 
cern  important  characteristics  to  be  used  for  failure  detec¬ 
tion  and  isolation.  Chapter  II,  Table  IV  contains  the  flight 
profile  which  highlights  the  manuever  sequence.  All  such  fig 
ures  referenced  in  this  chapter  are  located  in  the  Appendix. 
The  failure  detection  processor  was  simulated  over  a  550  sec¬ 
ond  portion  of  the  flight  profile  given  in  Chapter  II  (0  thru 
550  seconds  for  the  benign  flight  and  2300  thru  2850  seconds 
for  the  dynamic  case) . 

As  a  result  of  the  characteristics  observed  in  the  ini¬ 
tial  no-failure  runs,  the  detection  logic  was  not  initialized 
for  operation  until  60  seconds  after  the  measurement  process 
had  actually  begun  (for  benign  flight,  the  measurement  process 
began  at  2500  seconds) .  This  delay  was  necessary  to  ensure 
that  the  filter  transients  had  dissipated  themselves  and  a 
reasonable  steady-state  condition  had  been  achieved.  The  simu¬ 
lation  times  of  interest  are  shown  in  Table  XI. 

Table  XI 

Simulation  Times  of  Interest 


Initial 

Simulated 

Type 

Start 

Meas 

Failure 

Finish 

Benign 

0  secs 

360  secs 

450  secs 

550  secs 

Dynamic 

2300  secs 

2500  secs 

2640  secs 

2850  secs 

No-Failure  Likelihood  Functions 

The  satellite  measurement  process  consists  of  six  measure¬ 
ments  (3-position,  3  velocity) .  Each  of  the  measurement  pro¬ 
cesses  is  tracked  by  its  own  likelihood  function  processor. 

The  thresholds  shown  in  Tables  XII  and  XIII  list  the  maximum 
values  for  each  likelihood  function  for  the  benign  and  dynamic 
cases,  respectively.  The  N-step  "window"  for  each  of  these 
likelihood  functions,  is  set  at  10.  This  value  is  justified 
based  on  the  work  of  Maybeck  (22).  Fig.'s  A. 24  thru  A. 29 
demonstrate  the  no-failure  likelihood  function  plots  for  be¬ 
nign  flight.  Fig.'s  A. 38  thru  A. 43  demonstrate  the  no-failure 
likelihood  function  plots  for  dynamic  flight. 

The  Doppler  measurement  process  consists  of  three  velo¬ 
city  measurements.  Again,  as  in  the  satellite  measurement  pro¬ 
cess,  each  measurement  is  tracked  by  its  own  likelihood  func¬ 
tion.  The  "windows"  for  the  likelihood  functions  are  set  at 
10.  Fig.'s  A. 44  thru  A. 46  are  the  likelihood  function  plots 
for  the  benign  case  and  Fig.'s  A. 76  thru  A. 78  are  the  likeli¬ 
hood  function  plots  for  the  dynamic  case. 

Terrain  correlator  processing  consists  of  three  position 
measurements.  Three  likelihood  functions  track  this  measure¬ 
ment  process  and  are  "windowed"  at  a  sample  size  of  10  (same 
as  previous  cases).  Fig.'s  A. 89  thru  A. 91  provide  the  likeli¬ 
hood  function  plots  for  the  benign  flight  and  Fig.'s  A. 92  thru 
A. 94  apply  to  the  dynamic  case. 

The  threshold  establishment  for  all  measurement  processes 
was  selected  by  adding  a  value  of  minus  one- tenth  (-.1)  to  the 


maximum  values  for  the  no-failure  likelihood  functions  shown 
in  the  no-failure  figures.  This  decision  is  primarily  based 
on  the  small  Monte  Carlo  sample  size  (10  samples)  which  was 
used  in  the  simulations.  By  adding  this  value,  a  conservative 
threshold  has,  in  fact,  been  proposed.  Any  simulated  failures 
which  have  magnitudes  beyond  this  value  are  then  declared. 
Tighter  thresholds  would  cause  a  greater  sensitivity  and  gen¬ 
erate  false  alarms.  The  false  alarm/missed  alarm  trade  off 
is  an  issue  in  itself. 

Satellite  Failure  Detection  (Benign) 

Table  XII,  found  later  in  this  Chapter,  lists  the  simulated 
failure  results  for  the  benign  case.  The  tabulated  results 
provide  a  significant  insight  into  the  failure  characteristics 
of  each  of  the  simulated  faults. 

Soft  gyro  failures,  (SGY1 : x-axis ,  SGY2:y-axis,  SGY3:z-axis) 
were  not  detectable  in  the  benign  case.  This  is  attributable 
to  the  integrations  that  the  soft  gyro  failures  (these  failures 
are  simulated  by  one- sigma  ramps  for  the  particular  gyro  error 
state  as  discussed  in  Chapter  IV)  must  pass  through  before  af¬ 
fecting  the  velocity  and  position  error  states  which  are  observ¬ 
able  in  the  measurement  process.  The  integration  processes, 
in  effect,  filter  out  the  failure  effects  before  they  can  sig¬ 
nificantly  influence  the  measurements.  These  soft  gyro  fail¬ 
ures  can  then  be  classified  as  unobservable  for  this  satellite 
measurement  process  with  failure  magnitude  as  the  single  detec¬ 
tion  parameter. 


Hard  gyro  failures  (modeled  as  100-sigma  jumps  at  the 
given  failure  time;  this  value  was  chosen  to  generate  a  rea¬ 
sonable  time-rate-of-change  for  the  failure  growth  (one  order 
of  magnitude)  over  the  detection  sample  interval)  are  plotted 
in  Fig.'s  A. 19  thru  A. 23.  These  failures  are  readily  observ¬ 
able  as  can  be  seen  in  Table  XII.  A  gyro  1  or  2  hard  failure 
(HGY1,  HGY2)  is  observable  in  measurements  4,  5,  and  6  which 
are  physically  the  3  velocity  error  states.  However,  a  gyro 
3  hard  failure  is  not  detected  by  any  of  the  measurements. 

Gyro  3  measures  angularities  about  the  2  platform  (aircraft 
axis  for  strapdown)  axis.  This  lack  of  gyro  3  sensitivity 
is  a  possible  indication  of  the  impact  of  the  coordinate  frame 
transformation  for  platform  to  navigation  frame.  Because  of 
the  direction  cosine  matrix  transformation,  the  gyro  3  failure 
characteristics  are  lost  in  the  transformation  possibly  due 
to  the  multiplication  by  a  very  small  sine  or  cosine  term  or 
terms . 

Soft  accelerometer  failures  (SAC1:  x-axis,  SAC2 :  y-axis, 
SAC3 :  z-axis)  (Fig.'s  A. 15  thru  A. 18)  produce  a  more  pronounced 
effect  on  the  likelihood  functions  than  those  observed  for  soft 
gyro  failures.  SAC1  magnitude  growth  was  observed  in  measure¬ 
ments  4  and  6,  corresponding  to  east  and  vertical  velocity 
error  states,  respectively.  SAC2  growth  is  observed  in  mea¬ 
surements  4  and  5  (north  velocity  error  state) .  A  SAC3  failure 
was  also  detected  by  measurement  6.  The  increased  observabil¬ 
ity  of  the  soft  accelerometer  failure  as  compared  to  the  soft 
gyro  failure  is  due  to  the  faster  influence  of  the  accelerometer 
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error  states  on  the  velocity  error  states  (i.e.,  gyro  failures 
must  pass  through  attitude  error  states  before  affecting  the 
velocity  error  states,  whereas,  accelerometer  errors  states 
affect  the  velocity  error  states  directly) . 

Hard  accelerometer  failures  (HAC1,  HAC2,  HAC3)  (Fig.'s 
A. 7  thru  A. 14)  are  also  observable  in  more  measurements  and 
are  of  greater  magnitude  than  gyro  failures  (a  function  of  the 
error  state  equation  coupling) . 

Soft  and  hard  satellite  failures  were  observed  in  mea¬ 
surements  4  5,  and  6,  respectively.  Soft  satellite  failures 

(SSATF)  (Fig.'s  A. 4  thru  A. 6)  do  not  appear  in  measurements  4, 
5,  or  6  since  no  direct  coupling  occurs  in  the  states  that 
affect  these  measurements.  The  hard  satellite  failures  (HSATF) 
(Fig.'s  A. 1  thru  A. 3)  produced  results  that  are  somewhat  con¬ 
trary  to  the  expected  results  (soft  failures  affected  measure¬ 
ments  1,  2,  and  3  and  thus,  one  would  expect  hard  failures  to 
have  even  more  impact  on  these  measurements) .  The  explanation 
of  these  results  is  attributable  to  the  way  the  hard  failures 
are  modeled.  These  hard  failures  are  simulated  by  zeroing  the 
satellite  error  states  in  the  measurement  equation  (this  tech¬ 
nique  for  modeling  is  discussed  in  Chapter  IV) .  These  errors 
are  small  compared  to  the  other  measurement  states  and  are 
quickly  compensated  for  by  the  filter.  These  soft  failures 
are  one-sigma  ramps  continuously  applied  to  the  error  states 
and  cannot  be  compensated  for  by  the  filter,  thus  producing 
large  residuals  and  eventual  likelihood  function  growth. 
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Satellite  Failure  Detection  (Dynamic) 

The  dynamic  simulation  for  the  satellite  measurement  pro¬ 
cess  produced  results  for  the  likelihood  functions  that  were 
surprising.  As  can  be  seen  by  Table  XIII  (found  later  in  this 
chapter) ,  the  likelihood  functions  were  generally  insensitive 
to  both  hard  and  soft  failures.  In  the  dynamic  simulation, 
the  failures  were  initialized  at  2640  seconds.  During  this 
period  of  time,  the  aircraft  is  performing  vertical  dives, 
jinking,  and  climbing  manuevers ;  it  could  well  be  the  case  that 
these  failures  are  being  masked  due  the  the  rapid  changes  in 
the  direction  cosine  matrix  for  platform  to  navigation  frame 
transformations .  The  cosine  and  sine  terms  in  this  matrix  are 
of  rapidly  changing  angles  which  most  likely  results  in  mini¬ 
mizing  a  large  failure.  This  is  a  practical  explanation  for 
gyro  and  accelerometer  failures,  but  what  about  the  change  in 
behavior  of  the  satellite  failures? 

The  soft  satellite  failure  (SSATF)  produced  the  same  mea¬ 
surement  failures,  but  the  dynamic  case  produced  failures  that 
were  of  greater  magnitude  that  the  benign  case.  However,  the 
time  to  failure  detections  is  much  longer  for  the  dynamic  case 
(See  Fig.'s  A. 30  thru  A. 32) .  One  could  surmise  that  the  dy¬ 
namic  case  is  less  sensitive  to  the  soft  satellite  failure; 
it  is  harder  to  distinguish  failure  effects  from  dynamic  ef¬ 
fects  in  a  harsh  dynamic  setting  than  in  a  benign  case. 

Hard  satellite  failures  were  unobservable  in  the  dynamic 
case.  The  hard  satellite  failure  has  the  same  explanation  as 
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Satellite  Likelihood  function  failure  Statistics  for  Dynamic  flight 


indicates  initial  failure  value  after  threshold 


given  for  the  benign  case  (i.e.,  small  magnitude  of  failure 
compared  to  the  other  measurement  states).  The  velocity  error 
states  are  being  rapidly  perturbed  by  the  harsh  maneuvers  which 
most  likely  causes  their  values  in  the  measurement  process  to 
"overshadow"  the  hard  failures  and,  in  essence,  make  the  fail¬ 
ure  unobservable. 

Hard  accelerometer  failures  (HACl,  HAC2,  HAC3)  were  de¬ 
tected  in  all  measurements.  However,  the  number  of  measure¬ 
ments  which  were  excited  by  the  failure  represents  a  signifi¬ 
cant  reduction  compared  to  the  benign  case.  Fig.'s  A.  35  thru 
A. 36  provide  the  likelihood  function  plots  for  these  failures. 

The  decreased  measurement  sensitivity  was  also  observed 
for  the  soft  accelerometer  failure  (SACl,  SAC 2 ,  SAC3) .  Fig. 

A. 37  shows  the  tracking  of  SAC2  failure  in  measurement  process 
4. 

Doppler  Failure  Detection  (Benign) 

The  results  for  Doppler  likelihood  function  failures  de¬ 
tection  are  shown  in  Table  XIV  which  is  found  later  in  this 
chapter.  The  Doppler  measurement  process  was  utilized  to  det¬ 
ermine  (through  likelihood  function  testing)what  effect  that 
hard  and  soft  gyro,  accelerometer,  and  Doppler  failures  have 
on  the  likelihood  functions.  Further,  this  was  done  to  estab¬ 
lish  what  characteristics  of  these  failures  could  be  exploited 
for  isolation  and  identification  processing.  The  dynamic 
flight  results  will  be  discussed  after  the  benign  results. 
Measurement  7  corresponds  to  the  east  velocity  error  state, 
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measurement  8  corresponds  to  the  north  velocity  error  state  and 
measurement  9  corresponds  to  the  vertical  velocity  error  state. 

Soft  gyro  failures  (SGY1,  SGY2,  SGY3)  were  not  observable 
in  the  likelihood  functions.  The  explanation  of  this  condition 
is  the  same  as  given  in  the  satellite  measurement  process. 

Hard  gyro  failures  (HGY1,  HGY3,  HGY3)  were  detected  in 
two  of  the  simulated  cases.  A  HGY1  failure  was  detected  in 
measurements  7  and  8  (See  Fig.'s  A. 47  and  A. 48).  A  HGY2  fail¬ 
ure  was  detected  in  measurements  7  and  8,  also  (See  Fig.'s  A. 49 
and  A. 50).  A  HGY3  failure  was  not  detected  by  any  of  the  mea¬ 
surement  processes.  A  HGY3  failure  would  not  be  expected  to  be 
observable  in  a  benign  flight  since  no  vertical  rate  changes 
are  taking  place.  This  is  an  observability  situation  which  would 
drastically  affect  the  INS  once  the  vertical  channel  becomes 
excited  by  a  maneuver.  Refer  to  Chapter  IV  for  a  discussion  of 
failure  types  (soft,  hard,  hard-over). 

Soft  accelerometer  failures  (SAC1,  SAC2,  SAC3)  were  de¬ 
tected  in  two  of  the  simulated  cases.  A  SAC1  failure  was  de¬ 
tected  in  measurement  processes  7  and  8  (See  Fig.'s  A. 53  and 
A. 54).  A  SAC  3  failure  was  not  observed  by  any  of  the  likeli¬ 
hood  functions.  Again,  the  unobservable  nature  of  the  SAC 3  fail¬ 
ure  is  due  to  the  benign  flight  environment  which  does  not  per¬ 
turb  the  vertical  states.  If  the  sensor  error  states  had  been 
used  explicitly  in  the  measurement  process  then  drastic  effects 
would  have  been  noted. 

Hard  accelerometer  failures  (HACl,  HAC2,  HAC3)  followed 
the  same  pattern  as  the  soft  accelerometer  failures  except  for 


the  HAC3  failure  (See  Fig.'s  A. 55  and  A. 56) .  The  HAC3  failure 
was  detected  by  measurement  processes  7  and  9  (See  Fig.'s  A. 57 
and  A. 58) . 

A  soft  Doppler  failure  (SDOP)  was  detected  by  all  three 
measurements  (See  Fig.'s  A. 59  thru  A. 61).  A  hard  Doppler  fail¬ 
ure  (HDOP)  was  only  detected  by  measurement  process  9  (See  Fig. 
A.  62) .  This  is  most  likely  due  to  the  rapid  recovery  of  the  mea 
surement  process  from  the  zeroing  of  the  particular  H  matrix 
entry  for  the  Doppler  error  state. 

Doppler  Failure  Detection  (Dynamic) 

The  dynamic  flight  simulation  for  Doppler  failures  showed 
a  tremendous  lack  of  sensitivity  for  various  failures  that  were 
observable  in  the  benign  case.  The  only  failures  that  produced 
observable  values  were  the  following:  hard  accelerometer  fail- 
ures;  HAC1  (See  Fig.'s  A. 71  and  A. 72),  HAC2  (See  Fig.'s  A. 67 
and  A. 68) ,  and  HAC3  (See  Fig.'s  A69  and  A. 70);  soft  accelero¬ 
meter  failures,  SAC1  and  SAC2  (See  Fig.'s  A. 64  thru  A. 66);  soft 
and  hard  Doppler  errors,  SDOP  (Fig.'s  A. 64  thru  A. 66)  and  HDOP 
(See  Fig.  A. 63).  The  only  tractable  explanation  for  this  lack 
of  sensitivity  is  the  fact  that  both  soft  and  hard  failures 
(except  for  HDOP)  were  injected  through  that  state  differen¬ 
tial  equations.  These  errors  must  first  be  transformed  through 
a  direction  cosine  matrix  which  carries  the  error  states  from 
the  platform  frame  to  the  navigation  frame.  Because  of  the 
harsh  manuevers  during  this  time  frame,  certain  angles  of  the 
coordinate  frame  transformation  become  both  extremely  large  and 
extremely  small.  When  these  angles  become  arguments  for  co¬ 
sines  and  sines,  the  failures  can  be  significantly  reduced 
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and  hard  to  distinguish,  resulting  in  missed  failures. 


The  explanation  for  HDOP  is  related  to  the  higher  no- fail¬ 
ure  dynamic  likelihood  function  magnitude  for  the  vertical  mea¬ 
sure  and  lower  value  for  measurement  8  which  make  the  failure 
detection  sensitivity  for  measurement  8  greater  than  for  mea¬ 
surement  9 . 

Terrain  Correlator  Failure  Detection  (Benign) 

The  terrain  correlator  measurement  process  results  are 
shown  in  Table  XV  which  appears  later.  Both  benign  and  dyna¬ 
mic  results  are  given  in  this  table.  The  discussion  initially 
deals  with  the  benign  case.  Dynamic  results  will  be  discussed 
at  the  end  of  this  section.  Measurements  10,  11,  and  12  cor¬ 
respond  to  the  east  position  error  state,  north  position  error 
state,  and  vertical  position  error  states,  respectively. 

Soft  gyro  failures  (SGY1,  SGY2,  SGY3)  did  not  change  the 
likelihood  function  values  from  the  no- failure  condition.  This 
is  consistent  with  the  findings  for  both  the  satellite  and  Dop¬ 
pler  results  and  the  same  explanation  is  proposed  for  this  case. 

Hard  gyro  failure  (HGY1,  HGY2,  HGY3)  were  not  detected  for 
any  of  the  cases.  This  is  consistent  with  the  satellite  posi¬ 
tion  measurements  and  the  conditions  for  this  unobservable  be¬ 
havior  are  explained  in  the  satellite  position. 

Soft  accelerometer  failures  (SAC1,  SAC2,  SAC3)  were  basic¬ 
ally  only  observable  in  measurement  10  (See  Fig.'s  A. 79  andA.86) 
Their  magnitude  (related  to  the  no- failure  condition)  is  not  a 
significant  increase.  A  failure  declaration  for  these  failures 
would  require  extremely  tight  thresholds.  One  could  state  that 
these  failures  are  slightly  observable. 

Hard  accelerometer  failures  (HAC1,  HAC2,  HAC3)  produced 


significant  changes  in  the  likelihood  functions  for  all  3  mea¬ 
surements.  A  HAC1  failure  was  observable  in  measurements  10 
and  11  (See  Fig.'s  A. 87  and  A. 88).  A  HAC2  failure  was  observ¬ 
able  in  measurements  10  and  11  (  See  Fig.'s  A. 84  and  A. 85). 

A  HAC3  failure  was  detected  in  measurement  12  (See  Fig.  A. 82). 
When  compared  to  the  satellite  position  results,  a  greater 
sensitivity  was  seen  in  HAC1,  HAC2,  and  HAC3  failures  for  the 
terrain  correlator.  The  exact  reason  for  this  greater  sensi¬ 
tivity  is  not  clear.  It  is  possible  that  the  filter  tuning 
for  the  satellite  position  measurement  process  requires  add¬ 
itional  effort.  Filter  tuning  will  be  discussed  in  the  Chap¬ 
ter  VI,  Recommendations. 

A  hard  radar-altimeter  failure  (HRAF)  was  found  in  mea¬ 
surement  process  3  (See  Fig.  A.  80).  Again,  this  is  what 
was  expected.  The  magnitude  of  this  failure  was  significant 
and  rapid  detection  of  this  type  of  failure  should  occur. 

A  hard  baro-accelerometer  failure  (HBAF)  was  highly  ob¬ 
servable  in  measurement  3  (See  Fig.  A. 83).  The  failure  mag¬ 
nitude  should  make  the  detection  processor  react  quickly. 

Terrain  Correlator  Failure  Detection  (Dynamic) 

The  dynamic  flight  results  shown  in  Table  XV,  demonstrate 
a  different  type  of  behavior  than  that  which  was  seen  in  both 
the  satellite  and  Doppler  measurements.  Satellite  and  Doppler 
dynamic  results  demonstrated  a  tremendous  decrease  in  failure 
sensitivity  compared  to  the  benign  case  results,  which  was 
attributed  to  coordinate  frame  transformation  conditions.  The 
terrain  correlator  dynamic  flight  results  show  a  "redistribu¬ 
tion"  of  the  failure  magnitudes.  However,  one  has  to  hypothe- 


size  the  same  explanation  for  this  condition  since  the  "re¬ 
distribution"  could  only  take  place  through  a  direction  cosine 
matrix  transformation. 

Both  soft  and  hard  gyro  failures  were  not  observed.  This 
is  consistent  with  the  results  noted  for  the  satellite  posi¬ 
tion  measurements. 

Soft  accelerometer  failures  (SAC1,  SAC2,  SAC3)  were  found 
in  measurement  process  10  (See  Fig.'s  A. 95  and  A. 96).  Again 
the  coordinate  frame  transformation  is  assumed  to  be  respons¬ 
ible. 

Hard  accelerometer  failures  (HAC2,  HAC2,  HAC3)  had  mixed 
results.  A  HAC1  failure  was  detected  in  measurements  10  and 
11  (See  Fig.'s  A. 97  and  A. 98).  A  HAC2  failure  was  found  in 
measurement  10  (See  Fig.  A. 99).  A  HAC3  failure  was  observed 
in  measurement  10  (See  Fig.  A. 100).  Again,  the  strong  coup¬ 
ling  into  measurement  process  10  is  consistent  with  the  other 
dynamic  results. 

A  soft  radar-altimeter  failure  (SRAF)  was  detected  in  mea¬ 
surement  process  12  (See  Fig.  A. 103).  This  failure  induced 
increase  in  likelihood  function  magnitude  was  extremely  small. 

A  hard  radar-altimeter  failure  (HRAF)  was  observable  in 
measurement  12  (See  Fig.  A. 104).  The  measurement  12  results 
were  expected  since  this  failure  was  injected  through  the  vert¬ 
ical  measurement  process. 

A  hard  baro-altimeter  failure  (HBAF)  was  detected  by  mea¬ 
surement  process  12  (See  Fig.  A. 105).  The  strong  magnitude 
of  the  failure  seen  in  measurement  12  was  expected  for  the  same 


reason  given  for  the  hard  radar-altimeter  failure. 

Another  Detection  Approach 

The  results  discussed  for  satellite,  Doppler,  and  terrain 
correlator  measurement  failure  detection  demonstrated  a  signif¬ 
icant  lack  of  sensitivity  utilizing  failure  magnitude  as  the 
sole  condition  for  failure  declaration.  The  use  of  thresholds 
(magnitude  limits)  for  failure  declaration  needs  to  be  com¬ 
plemented  by  some  other  form  of  "trigger"  which  monitors  an¬ 
other  characteristic  of  the  likelihood  function.  The  two 
failure  detectors  working  together  should  improve  the  detec¬ 
tion  process.  Evaluation  of  the  likelihood  functions  for  the 
various  measurement  processes  offered  a  possible  parameter 
which  could  be  utilized.  Under  failed  conditions,  likelihood 
functions  for  observable  failures  demonstrate  a  negative  value 
increase  (i.e.,  magnitude  increase).  However,  these  increases 
may  be  unobserved  because  the  use  of  a  conservative  threshold 
will  not  detect  the  failure.  This  "negative  increase"  char¬ 
acteristic  of  the  failure  can  be  exploited.  Additionally,  one 
could  also  use  tighter  threshold  with  time- to-failure  declara¬ 
tion. 

A  negative  slope  detector  with  variable  sample  size  can 
be  developed  which  slides  along  the  likelihood  function.  This 
slope  detector  functions  by  working  with  the  N-step  likelihood 
function  "window"  to  observe  the  negative  growth  of  the  like 
lihood  function.  The  slope  detector  is  thus  an  M-step  "window" 
in  which  the  likelihood  function  operates.  The  equation  for 
the  likelihood  function  is  given  in  Eq.  4-24.  The  slope  de- 
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tector  takes  each  N-step  likelihood  function  value  and  compares 
it  to  the  next  likelihood  function  value.  If  the  next  value 
is  more  negative  than  the  preceeding  value ,  the  next  likelihood 
function  value  is  tested.  This  process  continues  until  such 
time  as  the  preestablished  Mth-step  has  been  reached  (at  which 
time  a  failure  is  declared),  or,  if  a  sample  fails  the  test, 
the  M-step  process  is  reinitialized  from  this  negative  sample. 
The  sensitivity  (window  size)  can  be  established  based  on  the 
no-failure  flight  characteristics .  Once  this  is  done,  a  fail¬ 
ure  should  be  declared  if  the  M-step  window  found  M  samples 
in  which  each  successive  sample  was  more  negative  than  the  pre¬ 
ceeding  sample  or  samples . 

This  additional  detection  will  be  exercised  against  the 
same  flight  profiles  as  the  magnitude  detector  in  a  stand  alone 
fashion.  Once  this  has  been  done,  the  results  of  threshold 
testing  and  the  slope  detector  will  be  combined  to  determine 
their  joint  capability. 

No-Failure  Slope  Detection 

The  establishment  of  the  suitable  "window"  size  for  the 
slope  detector  was  based  on  finding  the  sensitivity  point 
(point  at  which  no  failures  are  declared  under  no- failure  con¬ 
ditions)  for  each  of  the  likelihood  functions  for  both  benign 
and  dynamic  flight.  Exercising  each  of  the  measurement  pro¬ 
cesses  over  the  same  flight  profiles  (same  likelihood  function 
results) ,  the  slope  detectors  were  tuned  to  be  insensitive  to 
the  slope  characteristics  for  no-failure  operation.  The  end 
results  of  this  tuning  produced  the  following  "windows"  for 


the  slope  detector: 


1. )  Satellite  (Benign)  4 

2. )  Satellite  (Dynamic)  7 

3. )  Doppler  (Benign)  6 

4. )  Doppler  (Dynamic)  7 

5. )  Terr  Corr  (Benign)  6 

6. )  Terr  Corr  (Dynamic)  6 

r  Satellite  Slope  Failure  Detection  (Benign) 

i 

Tables  XVI  and  XVII,  found  later  in  this  chapter,  contain 
the  results  of  the  failure  simulations  for  this  measurement 

sequence.  The  most  significant  impact  of  this  failure  detec- 

I 

tion  process  is  found  in  the  hard  accelerometer  failures  and 
soft  satellite  failures.  A  lesser  capability  is  found  for 
,  soft  accelerometer  failures. 

I 

Satellite  Slope  Failure  Detection  (Dynamic) 

Tables  XVI  and  XVIII  demonstrate  a  reduced  detection  cap- 
I  ability  when  compared  to  the  benign  slope  detection  capabil¬ 

ity.  However,  when  this  information  is  added  to  the  simple 
threshold  test,  additional  failure  information  has  been  made 
I  available. 

Doppler  Slope  Failure  Detection  (Benign) 

Tables  XVI  and  XIX  provide  the  information  for  this  mea- 
^  surment  sequence.  As  can  be  seen  in  Table  XVI,  there  is  very 

litcle  information  to  make  a  distinction  between  failures  with 
slope  detection  as  the  sole  test.  Table  XIX  provided  the  se- 
^  quence  for  a  particular  failure  and  does  provide  insight  as 

to  which  failure  is  identifiable  dependent  on  the  time  of  fail 
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ure  declaration. 


Doppler  Slope  Failure  Detection  (Dynamic) 

The  results  for  this  test  are  provided  in  Tables  XVI  and 
XX  which  are  found  later  in  this  chapter.  The  information  shown  in 
Table  XVI  demonstrates  a  greater  sensitivity  to  failures  than 
the  benign  case.  Table  XX  reveals  that  this  failure  informa¬ 
tion  should  contribute  significantly  to  the  decision  process. 

Terrain  Correlator  Slope  Failure  Detection  (Benign) 

A  small  failure  detection  capability  is  found  in  Tables 
XVI  and  XXI.  The  only  failures  which  were  detectable  with  this 
technique  were  hard  accelerometer  failures.  Table  XXI  provides 
the  time-of-failure  sequence  for  these  failures. 

Terrain  Correlator  Slope  Failure  Detection  (Dynamic) 

A  significant  change  from  the  benign  case  is  noted  in 
Tables  XVI  and  XXII.  The  detection  capability  diminished  for 
the  hard  accelerometer  failures  but  improved  for  soft  accel¬ 
erometer  failures . 

Slope  Detection  Analysis 

This  technique  has  demonstrated  a  notable  contribution  to 
the  failure  declaration  decision  process.  Especially  in  the 
dynamic  case,  a  significant  improvement  in  failure  detection 
was  achieved.  The  most  notable  class  of  failure  was  hard  ac¬ 
celerometer  failures.  Soft  accelerometer  failures  also  gained 
additional  information  for  failure  isolation.  It  can  be  sur¬ 
mised  that  the  combination  of  these  results  with  those  achieved 
by  simple  threshold  establishment  should  offer  a  more  divers- 
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ified  failure  isolation  algorithm.  This  failure  information 
for  the  joint  detection  logic  is  given  in  Tables  XXIII  thru 
XXIX. 

The  FDI  Detection  Processor 

The  failure  detection  capability  for  each  of  the  mea¬ 
surement  processes  is  shown  in  Tables  XXIII  thru  XXIX.  The 
information  derived  from  these  tables  will  be  utilized  to 
develop  a  suitable  isolation/identification  algorithm  and 
software  implementation.  The  significant  aspect  of  this 
complete  detection  processor  will  be  the  reliance  on  both 
simple  threshold  and  slope  detection  failure  sequence  for 
a  decision.  For  instance,  as  noted  in  Tables  XXIII  and  XXIV 
a  HAC1  failure  during  satellite  measurement  (benign  flight) 
would  result  in  the  following  sequence  for  each  detection 
method: 

Threshold  Slope 

5- 470  sec  4-490  sec 

4-480  sec  6-495  sec 

6- 485  sec  3-510  sec 

5-520  sec 

As  can  be  seen  from  this  data,  four  additional  votes  are  avail¬ 
able  from  the  slope  detector  to,  in  effect,  enhance  the  fail¬ 

ure  decision  process.  This  same  argument  can  be  repeated  for 
all  Table  XXIII  entries  where  both  simple  threshold  and  slope 
detection  logic  have  generated  a  measurement  failure  sequence 
for  a  particular  fault.  The  pattern  for  each  type  of  failure 
would  hopefully  generate  a  simple  decision  set.  One  point  that 


should  be  made  is,  the  hard  failure  of  an  INS  sensor  (gyro 
or  accelerometer)  dictates  a  failed  INS.  Therefore,  the  sim¬ 
ple  logic  of  declaring  an  INS  failure  vs.  a  specific  INS  com¬ 
ponent  is  justified.  In  some  cases  (soft  failures)  the  iso¬ 
lation  to  a  specific  gyro  or  accelerometer  could  allow  the 
sensor  to  continue  to  operate  if  the  additional  error  from 
the  soft  failure  could  be  compensated  for  in  the  filter  struc¬ 
ture  (e.g.,  increasing  the  measurement  noise  strength,  R) . 

For  external  aiding  devices,  the  same  argument  as  given 
in  the  previous  paragraph  holds.  This  simplifies  the  isola¬ 
tion  process  where  the  desire  for  simplicity  is  a  key  issue. 

The  isolation  capability  of  the  processor  demonstrate  a 
diversified  decision  table  which  decreases  the  ambiguities 
and  increases  the  probability  of  a  correct  isolation. 

Table  XXIV  demonstrates  a  significant  isolation  capa¬ 
bility  for  the  satellite  benign  case  with  the  only  ambiguities 
noted  for  the  hard  gyro  failure  isolation.  However,  once  a 
hard  gyro  failure  of  any  kind  has  been  noted,  the  INS  has 
failed  so  isolation  to  a  specific  sensor  is  not  necessarily 
important.  Table  XXV  contains  the  information  for  the  satel¬ 
lite  dynamic  case.  Although  this  is  a  significant  reduction 
in  capability,  the  isolation  process  for  those  failures  that 
were  detectable  had  an  enhanced  failure  isolation  capability 
vs.  a  single  test  of  either  type. 

Table  XXVI  contains  the  information  for  the  benign  Doppler 
case.  As  can  be  seen  from  the  table,  ambiguity  exists  for  the 
hard  gyro  failure  isolation  capability.  All  other  failures 


r 


are  distinct  from  each  other.  Table  XXVII  provides  the  data 
for  the  dynamic  Doppler  detection  isolation  capability.  Agai 
there  is  an  ambiguity;  however,  this  time  it  is  for  the  soft 
accelerometer  failures.  If  one  is  willing  to  use  a  time- 
to-failure  declaration  algorithm,  then  this  ambiguity  can  be 
removed.  All  other  failures  generated  distinct  failure  se¬ 
quences  . 

Table  XXVII  demonstrates  a  severe  ambiguity  problem  for 
the  terrain  correlator  benign  case.  Ambiguities  exist  in 
both  soft  accelerometer  failures,  soft  and  hard  radar  alti¬ 
meter  failures  and  hard  baro-alti meter  failures.  The  only 
way  to  begin  to  overcome  this  problem  would  be  a  failure 
growth  rate  test  or  some  other  form  of  test  to  isolate  the 
failures  based  on  a  single  measurement  failure.  Table  XXIX 
which  provides  information  for  the  dynamic  terrain  correlator 
case,  demonstrates  ambiguity  problems,  also.  Soft  accelero¬ 
meter  failures,  hard  radar-altimeter  failures,  and  hard  baro- 
altimeter  failures  had  ambiguity  problems.  Again,  some  form 
of  time- to-fai lure  parameter  or  growth  rate  test  would  aid 
the  isolation  capability. 

Table  XXIII  summarizes  the  combined  failure  detection 


capability  for  this  FDI  processor.  As  demonstrated  by  this 
table,  all  soft  gyro  failures  (SGY1,  SGY2,  SGY3 )  were  unde¬ 
tected  by  the  measurement  processes  (LF#1  thru  LF#12);  there¬ 
fore,  some  other  failure  detection  methodology  must  be  em¬ 
ployed  to  discern  failures  of  this  type.  Hard  gyro  failures 
(HGY1,  HGY2)  were  detectable  by  LF#4  thru  LF#8  for  the  benign 


case.  As  seen  in  Tables  XXIV  and  XXVI,  HGY1  and  HGY2  fail¬ 
ures  were  ambiguous  in  the  particular  failure  sequence;  how¬ 
ever,  the  use  of  a  time-between-f ai lure  test  (e.g.,  the  fail 
ure  time  between  LF#7  and  LF#8)  could  remove  this  ambiguity. 
No  hard  gyro  failures  were  observed  in  the  dynamic  case. 
Table  XXIII  also  demonstrates  the  fact  that  there  are  no 
ambiguities  for  soft  accelerometer  failures  (SAC1,  SAC2 , 

SAC3 )  in  the  benign  case.  A  SAC1  failure  is  discernable 
from  a  SAC2  failure  because  LF#6  detects  a  SAC2  failure  but 
does  not  detect  the  SAC1  failure.  In  the  dynamic  case,  this 
same  argument  holds  except  LF#5  detects  a  SAC2  failure  but 
does  not  detect  a  SAC1  failure.  Hard  accelerometer  fail¬ 
ures  (HAC1 ,  HAC2 ,  HAC3 )  did  not  produce  any  ambiguity  prob¬ 
lems  for  either  the  benign  or  dynamic  case.  This  is  evi¬ 
denced  by  the  results  shown  in  Table  XXIII  and  further  re¬ 
fined  by  Tables  XXIV  thru  XXIX.  The  remaining  failure  types 
shown  in  Table  XXIII  will  not  be  addressed  since  they  are 
aiding  device  peculiar. 

In  summary,  this  analysis  indicated  an  enhanced  deci¬ 
sion  capability  for  the  total  (threshold  and  slope)  FDI  sys¬ 
tem.  However,  ambiguity  problems  exist  that  need  to  be  ad¬ 
dressed. 
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+  magnitude  threshold  violation;  *  slope  failure  declaration 
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VI.  Conclusions  And  Recommendations 

Conclusions 

This  thesis  has  dealt  with  the  development  of  a  suitable 
filter  model  and  failure  detection/identification  (FDI)  pro¬ 
cessor  for  and  adaptive  tactical  navigation  (ATN)  system 
model.  A  thorough  review  of  the  present  FDI  techniques  was 
conducted  and,  based  on  this  information,  an  innovations- 
based  approach  was  selected.  A  likelihood  function  resid¬ 
ual  monitoring  methodology  was  developed  for  the  measure¬ 
ment  processes.  Based  on  the  characteristics  of  the  observed 
likelihood  function  values,  a  suitable  failure  detection 
algorithm  was  developed.  The  observed  failure  "signature" 
due  to  an  introduced  soft  or  hard  failure  was  then  tabu¬ 
lated  to  establish  the  basis  for  an  isolation  processor. 

The  performance  of  the  FDI  processor  provided  a  base¬ 
line  insight  into  its  limitations  and  capabilities.  The 
processor,  as  it  is  presently  implemented,  lacks  sensitivity 
to  gyro  failures.  This  is  due  to  the  number  of  integrations 
between  the  injected  failure  and  the  error  state  which  is 
present  in  the  explicit  measurement  equation.  The  use  of  both 
simple  threshold  settings  and  the  slope  detection  methodology 
in  the  failure  detection  processor  provided  generally  accept¬ 
able  results.  Suggestions  for  areas  of  future  consideration 
with  respect  to  FDI  methodology  will  be  made  in  the  Recom¬ 
mendation  section. 

The  filter  model  which  was  developed  for  this  thesis 


resulted  in  a  26-state  representation  for  a  52-state  "truth" 
model.  The  proper  tuning  of  this  filter  presented  some  pro¬ 
blems  due  to  the  model  reduction  for  certain  sensors.  The 
establishment  of  suitable  values  for  the  dynamic  driving  noise 
strength,  Q,  and  the  measurement  noise  strength,  R,  warranted 
the  addition  of  pseudonoises  to  the  position  error  states  of 
the  INS  to  prevent  divergence.  The  addition  of  this  pseudo¬ 
noise  provided  satisfactory  performance  but  better  perform¬ 
ance  may  be  achieved  by  readjustment  of  dynamic  noise  strengths 
for  other  filter  states. 

The  software  development  has  now  reached  the  point 
where  the  isolation/ identification  algorithm  can  be  imple¬ 
mented. 

Recommendations 

The  following  recommendations  are  being  made  to  improve 
the  overall  performance  of  the  FDI  system  and  provide  more 
insight  into  the  FDI  methodology. 

1.)  The  state  reduction  for  the  filter  model  results 
in  the  addition  of  noise  to  compensate  for  un¬ 
modeled  error  states  for  various  sensors.  Fur¬ 
ther  sensitivity  studies  should  be  conducted  to 
determine  what  practical  changes  may  be  necess¬ 
ary  to  provide  a  filter  that  indeed  contain  the 
states  needed  for  proper  operation.  The  evalu¬ 
ation  of  the  present  filter  suggests  there  may 
be  unmodeled  states  which  affect  the  filter  per¬ 
formance  (especially  in  a  dynamic  flight  environment  ) 


2. )  The  present  failure  detector  is  based  on  simple 

threshold  surpassing  and  slope  detecting  cri¬ 
teria.  Other  innovations-based  detection  schemes 
are  available  which  could  be  augmented  with  the 
existing  detection  structure  to  establish  a  lower 
rate  of  missed  and/or  false  alarms,  etc.  One 
such  technique  which  was  addressed  in  Chapter  I 
is  the  generalized  likelihood  ratio  (GLR) .  This 
method  can  be  implemented  easily  since  the  quan¬ 
tities  are  already  available  in  the  existing  de¬ 
tection  software.  Also,  one  could  utilize  tight¬ 
er  thresholds  with  time- to-failure  declaration 
plus  looser  thresholds  with  immediate  delcaration 
for  tracking  soft  and  hard  failures,  respectively. 
Another  method  could  utilize  additional  filters 
for  detection  only.  These  filters  are  not  updated 
N-sample  periods  to  enhance  their  failure  sensi¬ 
tivity.  Further,  one  could  implement  a  multiple 
model  filter  in  which  specific  failures  are  ex¬ 
plicitly  modeled  in  the  filter  structure. 

3. )  Further  "tuning"  needs  to  be  accomplished  on  the 

detection  thresholds  to  develop  a  desirable  trade 
off  between  false  and  missed  alarms.  As  part  of 
this  "tuning"  process,  the  detection  window  size, 
N,  should  be  evaluated  and  adjusted  to  maximize 
the  sensitivity  of  the  likelihood  function,  but 
constrained  by  the  need  to  prevent  trivial  (no- 


failure)  singularly  large  residuals  from  genera¬ 
ting  false  alarms. 

4. )  The  window  adjustment  for  the  slope  detector  also 

has  a  sensitivity  which  must  be  adjusted  to  mini¬ 
mize  the  false  alarms/missed  alarms.  This  adjust¬ 
ment  should  also  be  considered  for  failure  detec¬ 
tion  enhancement.  Also,  some  form  of  algorithm 
could  be  developed  for  adaptive  window  sizing 
based  on  the  dynamic  environment.  This  in  es¬ 
sence  allows  sensitivity  adjustment  for  failure 
detection. 

5. )  The  Monte  Carlo  process  should  be  based  on  a 

larger  number  of  samples  to  generate  statistics 
which  are  more  accurately  representative  of  true 
performance.  The  reason  that  only  10  samples  were 
used  for  this  research  was  due  to  time  constraints 
Increasing  the  number  of  Monte  Carlo  runs  will  un¬ 
doubtedly  require  a  retuning  of  the  filter  which 
will  even  carry  over  to  the  threshold  settings  for 
the  likelihood  functions.  This  retuning  was  pre¬ 
viously  addressed  in  (3) . 


Appendix:  Likelihood  Function  Plots 

This  appendix  contains  the  plotted  results  for  the  various  failures 
which  were  simulated.  The  information  gathered  from  these  plots  suppor 
the  discussion  presented  in  Chapter  V. 
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istios  are,  utilized  for  this  purpose.  Based  on  the  statistics  of 
the  observed  failure  characteristics,  an  isolation?identifioatibh 
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doubtedly  improve  the  performance  of  this  system. 


h  . 

.  \ 


UK CLASSIFIED 


security  classification  of  this  face 


